| Description | Example | Can have integrity metadata 1 | Content-Security-Policy support for hashes | Integrity-Policy support 2 |
|---|---|---|---|---|
| External script | <script src=http://> |
Yes (integrity attribute) |
Yes | Yes |
| Inline script | <script>alert("hello world");</script> |
No 3 | Yes | No |
| Event handlers | onclick=alert(1) |
No | Yes (with 'unsafe-hashes') |
No |
| javascript: protocol | javascript:alert(2) |
No | Yes (with 'unsafe-hashes') |
No |
| Static import | import foo from "/bar.js" |
Yes ("importmap") |
Yes | Yes |
| Dynamic import | import("/script.js") |
Yes ("importmap") |
Yes | Yes |
| Eval | eval("alert('boo');")new Function() ... |
No | No 4 | No |
| WebAssembly | No | No | No | |
| Worker | new Worker("/worker.js") |
No | No | No |
| Worker scripts | importScripts("/foo.js") |
No | No | No |
| Worklet | audioWorklet.addModule() |
No | No | No |
| Service Worker | navigator.serviceWorker.register() |
No | No | No |
Footnotes
-
https://w3c.github.io/webappsec-subresource-integrity/#integrity-metadata-description ↩
-
Everything that is not supported by the Integrity-Policy is allowed to execute by default. ↩
-
The Inline Integrity proposal currently only adds support for signatures. ↩
-
Hashes for
eval()scripts are part of the script-src-v2 proposal. ↩
Worklets? The Worker stuff probably applies directly, except they use addModule() for additional scripts instead of importScripts()