javascript - Google Analytics sha384 完整性哈希不起作用

Question

我的 jekyll 应用程序中有一个谷歌分析脚本突然停止捕获访问者信息。我已确定哈希已弃用，并包含以下错误消息：

<script async src="https://www.googletagmanager.com/gtag/js?id=XYZ" integrity="sha384-MY HASH" crossorigin="anonymous"></script>
<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  gtag('js', new Date());

  gtag('config', 'UA-144775756-1');
</script>

在 Firefox 开发版中：

None of the “sha384” hashes in the integrity attribute match the content of the subresource.

在 Chrome 中：

GET https://www.googletagmanager.com/gtag/js?id=XYZ net::ERR_BLOCKED_BY_CLIENT

出于安全原因，我无法删除完整性哈希，我需要这些分析。

我曾尝试通过https://www.srihash.org/更改完整性哈希，但不幸的是没有真正改变。

我尝试添加 CSP 元标记：

<meta http-equiv="Content-Security-Policy" content="default-src 'self' https://www.googletagmanager.com">

但是，这会导致与上述相同的错误以及这些错误：

Refused to execute inline script because it violates the following Content Security Policy directive: "default-src 'self' https://www.googletagmanager.com". Either the 'unsafe-inline' keyword, a hash ('sha256-UVGwFlokk48rx16gP58wsQf8mf94VqVbcJorUyG9iug='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'script-src' was not explicitly set, so 'default-src' is used as a fallback.

Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self' https://www.googletagmanager.com". Either the 'unsafe-inline' keyword, a hash ('sha256-biLFinpqYMtWHmXfkA1BPeCY0/fNt46SAZ+BBk5YUog='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.

更新：

我能够使用此解决方案修复 CSP 错误，但哈希的原始问题sha384仍然存在。

标签： javascriptsecurityhashgoogle-analyticssubresource-integrity