I'm running into an issue where Wappler automatically modifies the integrity attribute of a jQuery <script> tag every time I save my main.ejs layout.
Original script tags
<script src="https://code.jquery.com/jquery-3.5.1.slim.min.js" integrity="sha384-DfXdz2htPH0lsSSs5nCTpuj/zy4C+OGpamoFVy38MVBnE+IbbVYUew+OrCXaRkfj" crossorigin="anonymous"></script>
<script src="/dmxAppConnect/dmxAppConnect.js"></script>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js" integrity="sha256-oP6HI9z1XaZNBrJURtCoUT5SUnxFr8s3BzRl+cbzUq8=" crossorigin="anonymous"></script>
After saving in Wappler
<script src="https://code.jquery.com/jquery-3.5.1.slim.min.js" integrity="sha384-DfXdz2htPH0lsSSs5nCTpuj/zy4C+OGpamoFVy38MVBnE+IbbVYUew+OrCXaRkfj" crossorigin="anonymous"></script>
<script src="/dmxAppConnect/dmxAppConnect.js"></script>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js" integrity="sha384-DfXdz2htPH0lsSSs5nCTpuj/zy4C+OGpamoFVy38MVBnE+IbbVYUew+OrCXaRkfj" crossorigin="anonymous"></script>
As shown above, Wappler replaces the correct SHA-256 integrity hash for the Google CDN jQuery 3.6.4 script with the SHA-384 hash from the earlier jQuery 3.5.1 Slim script.
This causes the browser to reject the script due to an SRI mismatch.
The only workaround I've found is to edit the file outside of Wappler, as any save within Wappler restores the incorrect integrity value.
Questions:
- Is there a setting to disable Wappler's automatic generation or modification of the
integrityattribute? - Has anyone else experienced this behavior?
- Is this a known bug in Wappler's HTML parser or script management?