Fingerprint 生成的 integrity 会带分号 “;”，请问如何去掉这个分号？ - 中文

link管理
链接快照平台
输入网页链接，自动生成快照
标签化管理网页链接
相关文章推荐
帅气的伏特加 · Fingerprint 生成的 ...· 12 小时前 ·
儒雅的菠萝 · GitHub - ...· 2 周前 ·
踢足球的豌豆 · 使用方法：使用 LINQ 查询或修改集合 ...· 3 周前 ·
腹黑的橡皮擦 · Erro ao executar o ...· 1 月前 ·
稳重的企鹅 · AS 3.0 + Gradle 4.1 - ...· 1 月前 ·
玉树临风的枇杷 · 子安武人搜索-樱花动漫· 5 天前 ·
很拉风的酱牛肉 · pandas align() 数据对齐 | ...· 1 周前 ·
暴走的电池 · OpenWrt Forum Archive· 2 周前 ·
冷冷的马铃薯 · 深圳中旅国际公馆 ...· 2 周前 ·
直爽的棒棒糖 · 观点|龙蜥操作系统捐赠的背后，是谁在推动？· 4 周前 ·
我的主题中会使用
  {{- $resource = $resource | fingerprint . -}}
  {{- $integrity = $resource.Data.Integrity -}}
生成 integrity 属性，例如：integrity="sha256-MvGBfFwfZs5Zwaqmkg5B6ovA3H1sJAtPJUqRcXQ&#43;nNA="
显然这个 sha256 中会携带分号 “;”，当我在配置 HTTP2 Server Push 时，这个分号会作为特殊符号影响到我的配置，请问有什么办法避免这个问题吗？
如果以下可试试：
 {{- $resource = $resource | fingerprint . -}}
 <p>{{- safeHTML $resource.Data.Integrity -}}</p>
不然可以试试：
 {{- $resource = $resource | fingerprint . -}}
 <p>{{- htmlUnscape $resource.Data.Integrity -}}</p>
              启用 --minify 就可以了，不启用 --minify 时，integrity 的值会被 HTML 转义（其中 + 被转义为 &#43;），启用后则不会。具体原因不知为何，如果你认为这是 bug，可以向 Hugo 提出，我不太了解这方面。
hugo server --minify [...]
或者生产模式：
hugo --minify [...]
              你好，我按照你的方法，发现成功解决了这个问题，十分感谢！！！
当我通过 --minify 将 html 文件压缩后，生成的 html 标签会将 <…/> 转为 <…>，这回导致一些陈旧的搜索引擎无法识别，请问 --minify 有什么办法可以保留 </> 标签中的 “/” 吗？
如果这是原因的话那是HTML内容必须是安全的符号而转义 （encoding - The purpose of escaping html entities - Information Security Stack Exchange ）了。这样的话，那：
{{- $resource = $resource | fingerprint . -}}
 {{- warnf "%v\n" (htmlUnescape $resource.Data.Integrity) -}}
因该可以回复HTML安全转义前原来的数据。--minify是最后一步才运用（主要目的是把HTML内容给减肥）。
 razon:
如果你认为这是 bug，可以向 Hugo 提出，我不太了解这方面。
那不是bug。
{{ with resources.Get "main.js" }}
  {{ $resource := . | fingerprint }}
  {{ $integrity := $resource.Data.Integrity }}
  {{ $integrity }}
  {{ $integrity | htmlUnescape }}
  {{ $integrity | htmlUnescape | safeHTML }}
  <script src="{{ $resource.Permalink }}" integrity="{{ $integrity  }}"></script>
  <script src="{{ $resource.Permalink }}" integrity="{{ $integrity | safeHTML  }}"></script>
  <script src="{{ $resource.Permalink }}" integrity="{{ $integrity | safeHTMLAttr }}"></script>
  <script src="{{ $resource.Permalink }}" integrity="{{ $integrity | htmlUnescape }}"></script>
  <script src="{{ $resource.Permalink }}" integrity="{{ $integrity | htmlUnescape | safeHTML }}"></script>
  <script src="{{ $resource.Permalink }}" integrity="{{ $integrity | htmlUnescape | safeHTMLAttr }}"></script>
{{ end }}
  sha256-vr8D5wP7tDKB67QvAXK&#43;IxCVbWnStuegYrZX3SKnBPA=
  sha256-vr8D5wP7tDKB67QvAXK&#43;IxCVbWnStuegYrZX3SKnBPA=
  sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA=
  <script src="http://localhost:41771/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js" integrity="sha256-vr8D5wP7tDKB67QvAXK&#43;IxCVbWnStuegYrZX3SKnBPA="></script>
  <script src="http://localhost:41771/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js" integrity="sha256-vr8D5wP7tDKB67QvAXK&#43;IxCVbWnStuegYrZX3SKnBPA="></script>
  <script src="http://localhost:41771/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js" integrity="sha256-vr8D5wP7tDKB67QvAXK&#43;IxCVbWnStuegYrZX3SKnBPA="></script>
  <script src="http://localhost:41771/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js" integrity="sha256-vr8D5wP7tDKB67QvAXK&#43;IxCVbWnStuegYrZX3SKnBPA="></script>
  <script src="http://localhost:41771/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js" integrity="sha256-vr8D5wP7tDKB67QvAXK&#43;IxCVbWnStuegYrZX3SKnBPA="></script>
  <script src="http://localhost:41771/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js" integrity="sha256-vr8D5wP7tDKB67QvAXK&#43;IxCVbWnStuegYrZX3SKnBPA="></script>
--minify
sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA=
sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA=
sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA=
<script src=http://localhost:1313/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js integrity="sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA="></script>
<script src=http://localhost:1313/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js integrity="sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA="></script>
<script src=http://localhost:1313/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js integrity="sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA="></script>
<script src=http://localhost:1313/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js integrity="sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA="></script>
<script src=http://localhost:1313/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js integrity="sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA="></script>
<script src=http://localhost:1313/main.bebf03e703fbb43281ebb42f0172be2310956d69d2b6e7a062b657dd22a704f0.js integrity="sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA="></script>
{{ $resource := . | fingerprint }}

{{ $integrity := $resource.Data.Integrity }}

{{ $integrity }}

{{ $integrity | htmlUnescape }}

{{ $integrity | htmlUnescape | safeHTML }}

sha256-vr8D5wP7tDKB67QvAXK&#43;IxCVbWnStuegYrZX3SKnBPA=

sha256-vr8D5wP7tDKB67QvAXK&#43;IxCVbWnStuegYrZX3SKnBPA=

sha256-vr8D5wP7tDKB67QvAXK+IxCVbWnStuegYrZX3SKnBPA=

等一下，有点怪。
@bep, @jmooring, is the above code expected to be this way? As in, the module designer has to go through multiple partial functions just to obtain the pure SRI value (worse, 1 more extra step (strings.TrimPrefix) to obtain the pure shasum value)?
Basically, one has to:
{{ $resource := . | fingerprint -}}
{{ $integrity := $resource.Data.Integrity -}}
{{- $sri := string ($integrity | htmlUnescape | safeHTML) -}}
{{- $shasum := strings.TrimPrefix "sha256-" $sri -}}
The above discussion stated that --minify is the only way that is providing a much stable outcome and both pipelined functions and minify paths are showing inconsistencies.
Another weird pattern is that when the same algorithm is deployed across all the <script> tags, they are all presenting some weird values.
This is correct. All output must be HTMLEscape for safety reason. In that case, is --minify providing an unsafe HTML SRI value?
Note that this ticket is marked to be closed within 2 days due to system.
@razon, 我制造不出您的成果（如图）。但我需要上Sha512才能出产HTMLEscape的符号。这是运用您的代码。
2023-07-22-13-01-121071×328 56.5 KB




    

2023-07-22-13-03-361569×351 57.3 KB
2023-07-22-13-07-24911×412 68 KB
为有的差别就是我在Linux和运用hugo v0.111.2-4164f8fef9d71f50ef3962897e319ab6219a1dad。有差错吗？
Translation to English:
I cannot re-produce your reported error as stated (Please refer to screenshots). Moreover, I have to upgrade to SHA-512 in order to produce those HTML escapable symbols. I’m only using your provided codes.
The only differences are: I’m using Linux and hugo v0.111.2-4164f8fef9d71f50ef3962897e319ab6219a1dad. What are the differences on your side?
这是view-source （查看代码）， 不是Chrome的Inspector (f12 控制台)。目前您的代码证明不需要任何Partial功能可以直接处理SRI。
Translate to English:
This is view-source (for checking source code), not the Chrome’s F12 Inspector Console. At the moment, your source codes only proven there is no need for other partial processing functions and can render the SRI directly.
 hollowaykeanho:
2023-07-22-13-03-361569×351 57.3 KB
2023-07-22-13-03-361569×351 57.3 KB
这个是要显示目前所有的JS可以运用。
Translate to English:
This is to show all the JS are working.
              
image1832×162 3.47 KB
我试过了，即使 SHA512 也一样的，按理说，后面那串是 base64-encoded 字符串，应该不需要转义。
或者你看看配置是否开启了 minify，又或者试试我的版本：
$ hugo version
hugo v0.115.4-dc9524521270f81d1c038ebbb200f0cfa3427cc5+extended linux/amd64 BuildDate=2023-07-20T06:49:57Z VendorInfo=gohugoio
我试过了，即使 SHA512 也一样的，按理说，后面那串是 base64-encoded 字符串，应该不需要转义。
或者你看看配置是否开启了 minify，又或者试试我的版本：
$ hugo version
hugo v0.115.4-dc9524521270f81d1c038ebbb200f0cfa3427cc5+extended linux/amd64 BuildDate=2023-07-20T06:49:57Z VendorInfo=gohugoio
Translate request to English:
I tried; even with SHA512, the base64-encoded should require HTML Escape.
Or you can try minify and my hugo version.
两者都一样。看来您哪里要忙了。XD
        hugo server --noBuildLock \
                --disableFastRender \
                --port 8080 \
                --renderToDisk \
起动命令有分别吗？
没有minify：

2023-07-22-13-30-051898×335 106 KB
有Minify:

2023-07-22-13-31-381904×590 135 KB
(Translate to English)
Both are the same, looks like you might need to get busy.  (First picture without minify).
        hugo server --noBuildLock \
                --disableFastRender \
                --port 8080 \
                --renderToDisk \
Any differences with the server command?
              Sorry on my part. When I attempting to root cause the problem and clarify with both of you, apparently, I couldn’t reproduce the issue they are having.
It seems that the inconsistency issue is not related to SRI rendering but something else. We’re working on root causing the problem.
So far, I can use the SRI directly without needing any additional functions be it page rendering or actual value insertion. OP somehow got his/her generated SRI that is always HTML Escaped from the start which is undesirable.
Yeap. I have moved up to OP’s Hugo version and used his/her --minify workaround. The inconsistencies are still there (I don’t produce the HTML Escaped one; OP keep producing HTML Escaped version). Both of us are using the same Hugo version and test codes for now:
$ hugo version
hugo v0.115.4-dc9524521270f81d1c038ebbb200f0cfa3427cc5+extended linux/amd64 BuildDate=2023-07-20T06:49:57Z VendorInfo=gohugoio
UPDATE (from below):
Same server command as well.