From 87479e8ab18b6ab89a0b42fcc17881e41fd01808 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Fri, 24 Jul 2026 15:22:57 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Add=20SRI=20integrity=20checks?=
 =?UTF-8?q?=20for=20external=20dependencies?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added Subresource Integrity (SRI) hashes to:
- The JSZip CDN script tag
- The fetch call for the magick.wasm WebAssembly binary

This mitigates the risk of a compromised CDN serving malicious code.

Co-authored-by: paul0728 <44644609+paul0728@users.noreply.github.com>
---
 .gitignore      | 1 +
 docs/index.html | 6 ++++--
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 7a60b85..b4bc537 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 __pycache__/
 *.pyc
+node_modules/
diff --git a/docs/index.html b/docs/index.html
index 9d406c0..caa55c9 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -81,7 +81,7 @@
         }
     </style>
     <!-- Load JSZip for batch archiving -->
-    <script src="https://cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.js" integrity="sha384-+mbV2IY1Zk/X1p/nWllGySJSUN8uMs+gUAN10Or95UBH0fpj6GfKgPmgC5EXieXG" crossorigin="anonymous"></script>
 
     <!-- Load ESM from esm.sh to automatically handle CJS conversion -->
     <script type="importmap">
@@ -255,7 +255,9 @@ <h2>Online Converter</h2>
             try {
                 // Fetch the wasm file explicitly (use unpkg to ensure raw binary response)
                 const wasmUrl = "https://unpkg.com/@imagemagick/magick-wasm@0.0.30/dist/magick.wasm";
-                const response = await fetch(wasmUrl);
+                const response = await fetch(wasmUrl, {
+                    integrity: "sha384-mijzCtynibnb2Dqqwv/3Y+KGfHlSca0uaF6FJaMYUVByviMLDb5YcexhbvUWnKbF"
+                });
                 const wasmBytes = new Uint8Array(await response.arrayBuffer());
 
                 await initializeImageMagick(wasmBytes);