SRI on scripts

[scat0324]

Our vulnerability scanner flags the import of scripts from third party sites as a medium risk, and recommends SRI https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity to mitigate it. It provides the following hashes for use in the integrity attribute:

https://cdn.jsdelivr.net/npm/flatpickr
sha256-AkQap91tDcS4YyQaZY2VV34UhSCxu2bDEIgXXXuf5Hg=

https://unpkg.com/leaflet@1.7.1/dist/leaflet.js
sha256-yDc0eil8GjWFKqN1OSzHSVCiuGghTosZCcRje4tj7iQ=

https://cdn.jsdelivr.net/chartist.js/latest/chartist.min.js
sha256-UzffRueYhyZDw8Cj39UCnnggvBfa1fPcDQ0auvCbvCc=

[scat0324]

More on SRI and why it might not be the solution, particularly if the script is likely to change (the "latest" in the chartist URL worries me): https://shkspr.mobi/blog/2018/11/dynamic-javascript-and-sri/