id: missing-sri

info:
  name: Missing Subresource Integrity
  author: lucky0x0d,PulseSecurity.co.nz,sullo amarsct
  severity: info
  description: |
    Checks if external script and stylesheet tags in the HTML response are missing the Subresource Integrity (SRI) attribute.
  reference:
    - https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html#subresource-integrity
    - https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
  classification:
    cwe-id: CWE-353
  metadata:
    max-request: 1
  tags: compliance,js,css,sri,misconfig,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/"
    redirects: true
    max-redirects: 5

    matchers:
      - type: xpath
        part: body
        xpath:
          - "//script[contains(@src,'//') and not(matches(translate(@integrity,'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=','abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-'))]"
          - "//script[contains(@src, '//') and (not(@integrity) or not(matches(translate(@integrity, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=', 'abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-')))]"
          - "//link[@rel='stylesheet' and contains(@href, '//') and (not(@integrity) or not(matches(translate(@integrity, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=', 'abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-')))]"

    extractors:
      - type: xpath
        attribute: src
        xpath:
          - "//script[contains(@src,'//') and not(matches(translate(@integrity,'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=','abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-'))]"

      - type: xpath
        attribute: src
        xpath:
          - "//script[contains(@src, '//') and (not(@integrity) or not(matches(translate(@integrity, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=', 'abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-')))]"

      - type: xpath
        attribute: href
        xpath:
          - "//link[@rel='stylesheet' and contains(@href, '//') and (not(@integrity) or not(matches(translate(@integrity, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=', 'abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-')))]"
# digest: 490a00463044021f63e08858895b3515d836088cf04f75785353b95b09030504685489a941f701022100e90cf38982c35a031c20ce5fb862cc944b09f82cd78c7f69d82504661c37326b:922c64590222798bb761d5b6d8e72950