rules:
- id: missing-integrity
  metadata:
    category: security
    technology:
    - html
    cwe:
    - 'CWE-353: Missing Support for Integrity Check'
    owasp:
    - A08:2021 - Software and Data Integrity Failures
    confidence: LOW
    references:
    - https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures
    subcategory:
    - audit
    likelihood: LOW
    impact: LOW
  patterns:
  - pattern-either:
    - pattern: <script $...A >...</script>
    - pattern: <link $...A >
  - metavariable-pattern:
      metavariable: $...A
      patterns:
        - pattern-either:
          - pattern: src='... :// ...'
          - pattern: src="... :// ..."
          - pattern: href='... :// ...'
          - pattern: href="... :// ..."
          - pattern: src='//...'
          - pattern: src="//..."
          - pattern: href='//...'
          - pattern: href="//..."
        - pattern-not-regex: (?is).*integrity=
        - pattern-not-regex: (google-analytics\.com|fonts\.googleapis\.com|fonts\.gstatic\.com|googletagmanager\.com)
        - pattern-not-regex: .*rel\s*=\s*['"]?preconnect.*
  paths:
    include:
    - '*.html'
  message: >-
    This tag is missing an 'integrity' subresource integrity attribute. The
    'integrity' attribute allows for the browser to verify that externally
    hosted files (for example from a CDN) are delivered without unexpected
    manipulation. Without this attribute, if an attacker can modify the
    externally hosted resource, this could lead to XSS and other types of
    attacks. To prevent this, include the base64-encoded cryptographic hash of
    the resource (file) you’re telling the browser to fetch in the 'integrity'
    attribute for all externally hosted files.
  severity: WARNING
  languages: [generic]