chore: add integrity attribute to external links

lib/dotcom_web.ex

@@ -69,6 +69,7 @@ defmodule DotcomWeb do
           project_path: 3,
           project_update_path: 3,
           project_update_path: 4,
+          static_integrity: 2,
           static_url: 2
         ]
 

lib/dotcom_web/templates/fare/proposed_sales_locations.html.heex

@@ -33,7 +33,12 @@
         <script defer src={"#{Application.get_env(:dotcom, :webpack_path)}/tnm.js"}>
         </script>
       <% else %>
-        <script defer src={static_url(@conn, "/js/tnm.js")}>
+        <script
+          defer
+          src={static_url(@conn, "/js/tnm.js")}
+          integrity={static_integrity(@conn, "/js/tnm.js")}
+          crossorigin="anonymous"
+        >
         </script>
       <% end %>
     </div>

lib/dotcom_web/templates/fare/retail_sales_locations.html.heex

@@ -18,7 +18,12 @@
         <script defer src={"#{Application.get_env(:dotcom, :webpack_path)}/tnm.js"}>
         </script>
       <% else %>
-        <script defer src={static_url(@conn, "/js/tnm.js")}>
+        <script
+          defer
+          src={static_url(@conn, "/js/tnm.js")}
+          integrity={static_integrity(@conn, "/js/tnm.js")}
+          crossorigin="anonymous"
+        >
         </script>
       <% end %>
     </div>

lib/dotcom_web/templates/layout/root.html.heex

@@ -73,11 +73,35 @@
     <script :if={dev_server?} defer src={"#{webpack_path}/app.js"}>
     </script>
 
-    <link :if={!dev_server?} rel="stylesheet" href={static_url(@conn, "/css/core.css")} />
-    <link :if={!dev_server?} rel="stylesheet" href={static_url(@conn, "/css/app.css")} />
-    <script :if={!dev_server?} defer src={static_url(@conn, "/js/vendors.js")}>
+    <link
+      :if={!dev_server?}
+      rel="stylesheet"
+      href={static_url(@conn, "/css/core.css")}
+      integrity={static_integrity(@conn, "/css/core.css")}
+      crossorigin="anonymous"
+    />
+    <link
+      :if={!dev_server?}
+      rel="stylesheet"
+      href={static_url(@conn, "/css/app.css")}
+      integrity={static_integrity(@conn, "/css/app.css")}
+      crossorigin="anonymous"
+    />
+    <script
+      :if={!dev_server?}
+      defer
+      src={static_url(@conn, "/js/vendors.js")}
+      integrity={static_integrity(@conn, "/js/vendors.js")}
+      crossorigin="anonymous"
+    >
     </script>
-    <script :if={!dev_server?} defer src={static_url(@conn, "/js/app.js")}>
+    <script
+      :if={!dev_server?}
+      defer
+      src={static_url(@conn, "/js/app.js")}
+      integrity={static_integrity(@conn, "/js/app.js")}
+      crossorigin="anonymous"
+    >
     </script>
   </head>
   <%= content_tag(:body, class: Dotcom.BodyTag.class_name(@conn)) do %>
@@ -121,7 +145,13 @@
     somehow fail to execute unless additional scripts are included here. Let's
     revisit this when we either refactor app.js or refactor how we bundle
     scripts for production via Webpack.  --%>
-    <script :if={!dev_server?} defer src={static_url(@conn, "/js/react.js")}>
+    <script
+      :if={!dev_server?}
+      defer
+      src={static_url(@conn, "/js/react.js")}
+      integrity={static_integrity(@conn, "/js/react.js")}
+      crossorigin="anonymous"
+    >
     </script>
     <%!-- End unnecessary scripts --%>
     <!-- Google Tag Manager (noscript) -->

lib/dotcom_web/templates/project/index.html.heex

@@ -0,0 +1,62 @@
+<%= if Application.get_env(:dotcom, :dev_server?) do %>
+  <script defer src={"#{Application.get_env(:dotcom, :webpack_path)}/projects.js"}>
+  </script>
+<% else %>
+  <script
+    defer
+    src={static_url(@conn, "/js/react.js")}
+    integrity={static_integrity(@conn, "/js/react.js")}
+    crossorigin="anonymous"
+  >
+  </script>
+  <script
+    defer
+    src={static_url(@conn, "/js/projects.js")}
+    integrity={static_integrity(@conn, "/js/projects.js")}
+    crossorigin="anonymous"
+  >
+  </script>
+<% end %>
+
+<div class="container">
+  <div class="row">
+    <div class="col-lg-8">
+      <div class="page-section">
+        <%= PartialView.paragraph("paragraphs/custom-html/projects-index", @conn) %>
+      </div>
+    </div>
+  </div>
+</div>
+
+<div class="container">
+  <%= content_tag(
+    :div,
+    [
+      DotcomWeb.PartialView.render(
+        "_search_input.html",
+        Map.merge(assigns, %{
+          placeholder: "Enter keyword(s)",
+          aria_label: "Enter keywords",
+          prefix: "projects"
+        })
+      )
+    ],
+    id: "projects-search",
+    class: "hidden-no-js c-search-bar c-search-bar--embedded-large"
+  ) %>
+</div>
+
+<% [banner | featured] =
+  if Enum.empty?(@featured_project_teasers) do
+    [nil]
+  else
+    @featured_project_teasers
+  end %>
+
+<%= render("_all_projects.html",
+  banner: banner,
+  projects: @project_teasers,
+  featured_projects: featured,
+  project_updates: @project_update_teasers,
+  placeholder_image_url: @placeholder_image_url
+) %>

lib/dotcom_web/templates/schedule/_line.html.heex

@@ -0,0 +1,74 @@
+<% branchesEmpty? = Enum.empty?(@branches) %>
+<script
+  data-for="schedule-page"
+  id="js-schedule-page-data"
+  data-branches-are-empty={branchesEmpty?}
+  type="text/plain"
+>
+  <%= raw Poison.encode!(@schedule_page_data) %>
+</script>
+
+<% map_pdf_url = @route.type |> Routes.Route.type_atom() |> MapHelpers.map_pdf_url() %>
+
+<%= if display_map_link?(@route.type) do %>
+  <script id="static-map-data" type="text/plain">
+    <%= raw Poison.encode!(%{img_src: @map_img_src, pdf_url: map_pdf_url}) %>
+  </script>
+<% end %>
+
+<script id="js-map-data" data-channel-id={@channel} type="text/plain">
+  <%= raw Poison.encode!(@dynamic_map_data) %>
+</script>
+
+<link
+  rel="stylesheet"
+  href={static_url(@conn, "/css/map.css")}
+  integrity={static_integrity(@conn, "/css/map.css")}
+  crossorigin="anonymous"
+/>
+<%= if Application.get_env(:dotcom, :dev_server?) do %>
+  <script defer src={"#{Application.get_env(:dotcom, :webpack_path)}/schedule.js"}>
+  </script>
+<% else %>
+  <script
+    defer
+    src={static_url(@conn, "/js/react.js")}
+    integrity={static_integrity(@conn, "/js/react.js")}
+    crossorigin="anonymous"
+  >
+  </script>
+  <script
+    defer
+    src={static_url(@conn, "/js/schedule.js")}
+    integrity={static_integrity(@conn, "/js/schedule.js")}
+    crossorigin="anonymous"
+  >
+  </script>
+<% end %>
+
+<div class="page-section m-schedule-line">
+  <%= DotcomWeb.AlertView.group(
+    alerts: @alerts,
+    route: @route,
+    date_time: @date_time,
+    priority_filter: :high
+  ) %>
+  <div class="m-schedule-page row">
+    <%= if branchesEmpty? do %>
+      <div class="col-md-12 m-schedule-page__main-content">
+        <div class={"m-schedule-line__main-content #{if Routes.Route.type_atom(@route.type) == :ferry, do: "ferry"}"}>
+          <%= render("_empty.html",
+            date: @date,
+            direction: Routes.Route.direction_name(@route, @direction_id),
+            origin: nil,
+            destination: nil,
+            conn: @conn,
+            error: assigns[:schedule_error]
+          ) %>
+        </div>
+      </div>
+    <% end %>
+
+    <div id="react-root-schedule-page"></div>
+  </div>
+</div>

lib/dotcom_web/templates/stop/show.html.heex

@@ -0,0 +1,36 @@
+<link
+  rel="stylesheet"
+  href={static_url(@conn, "/css/map.css")}
+  integrity={static_integrity(@conn, "/css/map.css")}
+  crossorigin="anonymous"
+/>
+<div>
+  <div id="react-stop-root" data-mbta-stop-id={@stop_id}></div>
+</div>
+
+<%= if Application.get_env(:dotcom, :dev_server?) do %>
+  <script defer src={"#{Application.get_env(:dotcom, :webpack_path)}/stop.js"}>
+  </script>
+<% else %>
+  <script
+    defer
+    src={static_url(@conn, "/js/react.js")}
+    integrity={static_integrity(@conn, "/js/react.js")}
+    crossorigin="anonymous"
+  >
+  </script>
+  <script
+    defer
+    src={static_url(@conn, "/js/leaflet.js")}
+    integrity={static_integrity(@conn, "/js/leaflet.js")}
+    crossorigin="anonymous"
+  >
+  </script>
+  <script
+    defer
+    src={static_url(@conn, "/js/stop.js")}
+    integrity={static_integrity(@conn, "/js/stop.js")}
+    crossorigin="anonymous"
+  >
+  </script>
+<% end %>