Implement get_file_hash

components/site/src/lib.rs

@@ -551,6 +551,9 @@ impl Site {
             "get_taxonomy_url",
             global_fns::GetTaxonomyUrl::new(&self.config.default_language, &self.taxonomies),
         );
+        self.tera.register_function("get_file_hash", global_fns::GetFileHash::new(
+            vec![self.static_path.clone(), self.output_path.clone(), self.content_path.clone()]
+        ));
     }
 
     pub fn register_tera_global_fns(&mut self) {

components/site/tests/site.rs

@@ -693,6 +693,15 @@ fn can_cachebust_static_files() {
         "<link href=\"https://replace-this-with-your-url.com/site.css?h=83bd983e8899946ee33d0fde18e82b04d7bca1881d10846c769b486640da3de9\" rel=\"stylesheet\">"));
 }
 
+#[test]
+fn can_get_hash_for_static_files() {
+    let (_, _tmp_dir, public) = build_site("test_site");
+    assert!(file_contains!(public, "index.html",
+        "src=\"https://replace-this-with-your-url.com/scripts/hello.js\""));
+    assert!(file_contains!(public, "index.html",
+        "integrity=\"sha384-01422f31eaa721a6c4ac8c6fa09a27dd9259e0dfcf3c7593d7810d912a9de5ca2f582df978537bcd10f76896db61fbb9\""));
+}
+
 #[test]
 fn check_site() {
     let (mut site, _tmp_dir, _public) = build_site("test_site");

components/templates/src/global_fns/mod.rs

@@ -3,7 +3,7 @@ use std::path::PathBuf;
 use std::sync::{Arc, Mutex, RwLock};
 use std::{fs, io, result};
 
-use sha2::{Digest, Sha256};
+use sha2::{Digest, Sha256, Sha384, Sha512};
 use tera::{from_value, to_value, Error, Function as TeraFn, Result, Value};
 
 use config::Config;
@@ -82,7 +82,7 @@ fn open_file(search_paths: &Vec<PathBuf>, url: &String) -> result::Result<fs::Fi
             _ => continue
         };
     }
-    Err(format!("file {} not found; searched in {}", url,
+    Err(format!("file `{}` not found; searched in{}", url,
         search_paths.iter().fold(String::new(), |acc, arg| acc + " " + arg.to_str().unwrap())))
 }
 
@@ -92,6 +92,19 @@ fn compute_file_sha256(mut file: fs::File) -> result::Result<String, String> {
         .and_then(|_| Ok(format!("{:x}", hasher.result())))
         .map_err(|e| format!("{}", e))
 }
+fn compute_file_sha384(mut file: fs::File) -> result::Result<String, String> {
+    let mut hasher = Sha384::new();
+    io::copy(&mut file, &mut hasher)
+        .and_then(|_| Ok(format!("{:x}", hasher.result())))
+        .map_err(|e| format!("{}", e))
+}
+fn compute_file_sha512(mut file: fs::File) -> result::Result<String, String> {
+    let mut hasher = Sha512::new();
+    io::copy(&mut file, &mut hasher)
+        .and_then(|_| Ok(format!("{:x}", hasher.result())))
+        .map_err(|e| format!("{}", e))
+}
+
 
 fn get_cachebust_hash(search_paths: &Vec<PathBuf>, url: &String) -> Option<String> {
     match open_file(search_paths, url).and_then(compute_file_sha256) {
@@ -152,6 +165,47 @@ impl TeraFn for GetUrl {
     }
 }
 
+#[derive(Debug)]
+pub struct GetFileHash {
+    search_paths: Vec<PathBuf>,
+}
+impl GetFileHash {
+    pub fn new(search_paths: Vec<PathBuf>) -> Self {
+        Self { search_paths }
+    }
+}
+
+const DEFAULT_SHA_TYPE: u16 = 384;
+
+impl TeraFn for GetFileHash {
+    fn call(&self, args: &HashMap<String, Value>) -> Result<Value> {
+        let path = required_arg!(
+            String,
+            args.get("path"),
+            "`get_file_hash` requires a `path` argument with a string value"
+        );
+        let sha_type = optional_arg!(
+            u16,
+            args.get("sha_type"),
+            "`get_file_hash`: `sha_type` must be 256, 384 or 512"
+        ).unwrap_or(DEFAULT_SHA_TYPE);
+
+        let compute_hash_fn = match sha_type {
+            256 => compute_file_sha256,
+            384 => compute_file_sha384,
+            512 => compute_file_sha512,
+            _ => return Err("`get_file_hash`: `sha_type` must be 256, 384 or 512".into())
+        };
+
+        let hash = open_file(&self.search_paths, &path).and_then(compute_hash_fn);
+
+        match hash {
+            Ok(digest) => Ok(to_value(digest).unwrap()),
+            Err(e) => Err(e.into())
+        }
+    }
+}
+
 #[derive(Debug)]
 pub struct ResizeImage {
     imageproc: Arc<Mutex<imageproc::Processor>>,
@@ -400,7 +454,7 @@ impl TeraFn for GetTaxonomy {
 
 #[cfg(test)]
 mod tests {
-    use super::{GetTaxonomy, GetTaxonomyUrl, GetUrl, Trans};
+    use super::{GetTaxonomy, GetTaxonomyUrl, GetUrl, Trans, GetFileHash};
 
     use std::collections::HashMap;
     use std::env::temp_dir;
@@ -714,4 +768,42 @@ title = "A title"
             "https://remplace-par-ton-url.fr/en/a_section/a_page/"
         );
     }
+
+    #[test]
+    fn can_get_file_hash_sha256() {
+        let static_fn = GetFileHash::new(vec![TEST_CONTEXT.static_path.clone()]);
+        let mut args = HashMap::new();
+        args.insert("path".to_string(), to_value("app.css").unwrap());
+        args.insert("sha_type".to_string(), to_value(256).unwrap());
+        assert_eq!(static_fn.call(&args).unwrap(), "572e691dc68c3fcd653ae463261bdb38f35dc6f01715d9ce68799319dd158840");
+    }
+
+    #[test]
+    fn can_get_file_hash_sha384() {
+        let static_fn = GetFileHash::new(vec![TEST_CONTEXT.static_path.clone()]);
+        let mut args = HashMap::new();
+        args.insert("path".to_string(), to_value("app.css").unwrap());
+        assert_eq!(static_fn.call(&args).unwrap(), "141c09bd28899773b772bbe064d8b718fa1d6f2852b7eafd5ed6689d26b74883b79e2e814cd69d5b52ab476aa284c414");
+    }
+
+    #[test]
+    fn can_get_file_hash_sha512() {
+        let static_fn = GetFileHash::new(vec![TEST_CONTEXT.static_path.clone()]);
+        let mut args = HashMap::new();
+        args.insert("path".to_string(), to_value("app.css").unwrap());
+        args.insert("sha_type".to_string(), to_value(512).unwrap());
+        assert_eq!(static_fn.call(&args).unwrap(), "379dfab35123b9159d9e4e92dc90e2be44cf3c2f7f09b2e2df80a1b219b461de3556c93e1a9ceb3008e999e2d6a54b4f1d65ee9be9be63fa45ec88931623372f");
+    }
+
+    #[test]
+    fn error_when_file_not_found_for_hash() {
+        let static_fn = GetFileHash::new(vec![TEST_CONTEXT.static_path.clone()]);
+        let mut args = HashMap::new();
+        args.insert("path".to_string(), to_value("doesnt-exist").unwrap());
+        assert_eq!(
+            format!("file `doesnt-exist` not found; searched in {}",
+                    TEST_CONTEXT.static_path.to_str().unwrap()),
+            format!("{}", static_fn.call(&args).unwrap_err())
+        );
+    }
 }

docs/content/documentation/templates/overview.md

@@ -146,6 +146,21 @@ In the case of non-internal links, you can also add a cachebust of the format `?
 by passing `cachebust=true` to the `get_url` function.
 
 
+### 'get_file_hash`
+
+Gets the hash digest for a static file. Supported hashes are SHA-256, SHA-384 (default) and SHA-512. Requires `path`. The `sha_type` key is optional and must be one of 256, 384 or 512.
+
+```jinja2
+{{/* get_file_hash(path="js/app.js", sha_type=256) */}}
+```
+
+This can be used to implement subresource integrity. Do note that subresource integrity is typically used when using external scripts, which `get_file_hash` does not support.
+
+```jinja2
+<script src="{{/* get_url(path="js/app.js") */}}"
+        integrity="sha384-{{/* get_file_hash(path="js/app.js", sha_type=256) */}}"></script>
+```
+
 ### `get_image_metadata`
 Gets metadata for an image.  Currently, the only supported keys are `width` and `height`.
 

test_site/static/scripts/hello.js

@@ -0,0 +1 @@
+// test content

test_site/templates/index.html

@@ -23,5 +23,7 @@ <h3 class="post__title"><a href="{{ page.permalink }}">{{ page.title }}</a></h3>
             </div>
         {% endblock content %}
     </div>
+    <script src="{{ get_url(path="scripts/hello.js") | safe }}"
+            integrity="sha384-{{ get_file_hash(path="scripts/hello.js") }}"></script>
   </body>
 </html>