Skip to content

Instantly share code, notes, and snippets.

@ericlaw1979
Created April 5, 2018 18:05
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ericlaw1979/ace2af30fa2770c4dd288f1429e3839d to your computer and use it in GitHub Desktop.
Save ericlaw1979/ace2af30fa2770c4dd288f1429e3839d to your computer and use it in GitHub Desktop.
C# FiddlerScript SRI Hash Generator
[BindUITab("Resource Integrity Hashes", "<nowrap><nolink>")]
public static string ShowSRIHashr(Session[] arrSess) {
var oSB = new System.Text.StringBuilder();
for (int i = 0; i<arrSess.Length; i++)
{
if (arrSess[i].HTTPMethodIs("CONNECT")) continue;
if (!arrSess[i].bHasResponse)
{
oSB.AppendFormat("\r\n// Skipping incomplete response '{0}'\r\n", arrSess[i].fullUrl);
continue;
}
if (arrSess[i].responseCode != 200)
{
oSB.AppendFormat("\r\n// Skipping non-HTTP/200 response '{0}'\r\n", arrSess[i].fullUrl);
continue;
}
string sType = arrSess[i].oResponse.MIMEType.ToLower();
var bIsScript = sType.Contains("script");
var bIsCSS = sType.Contains("css");
if (!bIsScript && !bIsCSS)
{
oSB.AppendFormat("\r\n// Skipping non-CSS/JS response '{0}'\r\n", arrSess[i].fullUrl);
continue;
}
var sIntegrity = "sha256-" + arrSess[i].GetResponseBodyHashAsBase64("sha256").Replace("-", "")
+"\n\tsha384-" + arrSess[i].GetResponseBodyHashAsBase64("sha384").Replace("-", "")
+"\n\tsha512-" + arrSess[i].GetResponseBodyHashAsBase64("sha512").Replace("-", "");
if (bIsScript)
{
oSB.AppendFormat("\r\n<script src='{0}' crossorigin='anonymous'\r\n\tintegrity='{1}'></script>\r\n",
arrSess[i].fullUrl, sIntegrity);
}
else
{
oSB.AppendFormat("\r\n<link rel='stylesheet' crossorigin='anonymous'\r\n\thref='{0}'\r\n\tintegrity='{1}' />\r\n",
arrSess[i].fullUrl, sIntegrity);
}
}
return oSB.ToString();
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment