feat(@angular/build): subresource integrity validation for dynamically loaded modules by IchordeDionysos · Pull Request #33109 · angular/angular-cli

IchordeDionysos · 2026-04-30T13:48:34Z

Adds support for verifying the integrity of dynamically loaded sub-resources by generating and pre-pending an import map with integrity hashes in the index.html

Closes #30724

PR Checklist

Please check to confirm your PR fulfills the following requirements:

The commit message follows our guidelines: https://github.com/angular/angular-cli/blob/main/CONTRIBUTING.md#-commit-message-guidelines
Tests for the changes have been added (for bug fixes / features)
Docs have been added / updated (for bug fixes / features)

PR Type

What kind of change does this PR introduce?

What is the current behavior?

Currently, no integrity checks are done for dynamically loaded files, such as chunks.

Issue Number: #30724

What is the new behavior?

The integrity is validated by adding an importmap into as the first script of the index.html head with the integrity hashes of the dynamically loaded modules.

This will allow the browser to validate the integrity of dynamic imports.

The importmap will be added when Angular build is run with the --subresource-integrity flag.

Does this PR introduce a breaking change?

Yes
No

Other information

This PR is part of a two fold effort to enable SRI for our use of Angular.

While this can be shipped on it's own, there is an additional issue blocking us from using SRI, due to Sentry relying on Debug IDs but Angular not outputting them automatically: #33108

I would appreciate a feedback on the following PR implementing Debug IDs in Angular sourcemaps: #33110

gemini-code-assist

Code Review

This pull request introduces Subresource Integrity (SRI) support for lazy-loaded JavaScript chunks by generating an integrity-only import map within the index HTML. The changes include calculating SHA-384 hashes for browser output files and injecting them into a <script type="importmap"> block. Review feedback suggests refining the integrity map keys by removing hardcoded leading slashes to improve compatibility with various deployment configurations and filtering out initial bundles to avoid redundant metadata. Additionally, updates to the documentation and test suite were recommended to align with these refinements.

IchordeDionysos · 2026-04-30T13:54:55Z

Docs have been added / updated (for bug fixes / features)

I checked if there are any meaning docs regarding SRI but haven't found anything ...
The only mention was here: https://angular.dev/cli/build

Though I don't see a reason to update the docs, as there was no previous documentation of any limitations of SRI and the support now is just more complete.

clydin · 2026-04-30T15:45:56Z

Thank you for the contribution.
The concept appears sound and something we can include in the build process.

It appears that there are several lint and test failures. Can you fix those? And then the team can review.

IchordeDionysos · 2026-04-30T21:20:36Z

@clydin ahh yes sorry somehow slipped through been dangling multiple PRs regarding this topic.

This should now be fixed. It's passing on my local machine

IchordeDionysos · 2026-05-01T07:41:19Z

@clydin just squashed the commits :)

clydin

Looks like several files are out of format as well.

Thank you for the contribution.

clydin · 2026-05-01T14:28:47Z

+        const integrity = importmap.integrity['/' + file] ?? importmap.integrity[file];
+        if (integrity !== undefined) {
+          expect(integrity)
+            .withContext('integrity entry for ' + file)
+            .toBe(expectedSri);
+        }


Can you rework the logic for this part of the test? An empty import map will pass here which from the comment does not appear to be the intention.

Improved the tests here.

clydin · 2026-05-01T14:49:59Z

+      integrity[generateUrl(url, deployUrl)] = integrityHash;
+    }
+    headerLinkTags.push(
+      `<script type="importmap">${JSON.stringify({ integrity })}</script>`,


Unlikely to occur but can you escape the < character (\\u003c) from the stringified JSON?

Escaped it!

clydin · 2026-05-01T14:53:43Z

+
+  // Emit an integrity-only import map so the browser can validate lazy chunks
+  // resolved via dynamic `import()` (which otherwise carry no SRI metadata).
+  // The block is placed first inside `<head>` so it precedes any module


headerLinkTags will actually be at the bottom of the <head> since they are appended during the end tag event. Script tags are inserted into the <body> so still after the import map though.

Hmm good call out!
It was working for me when I tested it, but still wondering if we should be adjusting the code to append it right after the <base> tag, so add it here and here?

Unless the rewriter would always fire the base case startTag event when because the base tag is added when missing 🤔

@clydin I've implemented this now 😌

IchordeDionysos

Fixed the formatting issues

IchordeDionysos · 2026-05-02T13:16:16Z

+
+  // Emit an integrity-only import map so the browser can validate lazy chunks
+  // resolved via dynamic `import()` (which otherwise carry no SRI metadata).
+  // The block is placed first inside `<head>` so it precedes any module


Hmm good call out!
It was working for me when I tested it, but still wondering if we should be adjusting the code to append it right after the <base> tag, so add it here and here?

IchordeDionysos · 2026-05-02T13:16:30Z

+      integrity[generateUrl(url, deployUrl)] = integrityHash;
+    }
+    headerLinkTags.push(
+      `<script type="importmap">${JSON.stringify({ integrity })}</script>`,


Escaped it!

IchordeDionysos · 2026-05-02T15:49:08Z

+
+  // Emit an integrity-only import map so the browser can validate lazy chunks
+  // resolved via dynamic `import()` (which otherwise carry no SRI metadata).
+  // The block is placed first inside `<head>` so it precedes any module


Unless the rewriter would always fire the base case startTag event when because the base tag is added when missing 🤔

…y loaded modules Adds support for verifying the integrity of dynamically loaded sub-resources by generating and pre-pending an import map with integrity hashes in the index.html Closes angular#30724 Apply suggestions from code review Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> style: Fix lint issues test: Fix missing lazy modules resulting in test failures test: Adjust test to validate more specific assumptions fix: Escape < in generated importmap JSON style: fix all formatting issues in angular-build refactor: Inject importmap after base tag

IchordeDionysos mentioned this pull request Apr 30, 2026

feat(@angular/build): emit debug ids for stable subresource integrity hashes #33110

Open

13 tasks

angular-robot Bot added detected: feature PR contains a feature commit area: @angular/build labels Apr 30, 2026

gemini-code-assist Bot reviewed Apr 30, 2026

View reviewed changes

Comment thread packages/angular/build/src/tools/esbuild/index-html-generator.ts

Comment thread packages/angular/build/src/utils/index-file/augment-index-html.ts Outdated

Comment thread packages/angular/build/src/builders/application/tests/options/subresource-integrity_spec.ts Outdated

IchordeDionysos mentioned this pull request Apr 30, 2026

No subresource integrity validation for dynamically loaded chunks #30724

Open

1 task

IchordeDionysos force-pushed the feat/sub-resource-integrity-support-for-dynamic-chunks branch from 816b1a8 to 9f979e9 Compare May 1, 2026 07:40

clydin requested changes May 1, 2026

View reviewed changes

IchordeDionysos force-pushed the feat/sub-resource-integrity-support-for-dynamic-chunks branch 2 times, most recently from 7e19b0d to f6e5a94 Compare May 2, 2026 15:47

IchordeDionysos commented May 2, 2026

View reviewed changes

IchordeDionysos force-pushed the feat/sub-resource-integrity-support-for-dynamic-chunks branch from f6e5a94 to bc88ad9 Compare May 2, 2026 16:15

Conversation

IchordeDionysos commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Checklist

PR Type

What is the current behavior?

What is the new behavior?

Does this PR introduce a breaking change?

Other information

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

IchordeDionysos commented Apr 30, 2026

Uh oh!

clydin commented Apr 30, 2026

Uh oh!

IchordeDionysos commented Apr 30, 2026

Uh oh!

IchordeDionysos commented May 1, 2026

Uh oh!

clydin left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

IchordeDionysos left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

IchordeDionysos commented Apr 30, 2026 •

edited

Loading