From cc059ef04006e23752bf0aa0be1685cdbc32642f Mon Sep 17 00:00:00 2001
From: Lucky-Pulse <will.boucher@pulsesecurity.co.nz>
Date: Fri, 25 Aug 2023 15:28:32 +1200
Subject: [PATCH 1/3] Added check to see if script tags within the HTML
 response have Subresource Integrity implemented via the integrity attribute.

---
 http/misconfiguration/sri-missing.yaml | 39 ++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 http/misconfiguration/sri-missing.yaml

diff --git a/http/misconfiguration/sri-missing.yaml b/http/misconfiguration/sri-missing.yaml
new file mode 100644
index 0000000000..4822c5d404
--- /dev/null
+++ b/http/misconfiguration/sri-missing.yaml
@@ -0,0 +1,39 @@
+id: sri-missing
+info:
+  name: SRI missing
+  author: lucky0x0d,PulseSecurity.co.nz
+  severity: info
+  tags: javascript,subresource integrity
+  description: |
+     Checks if script tags within the HTML response have Subresource Integrity implemented via the integrity attribute
+  reference:
+    - https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html#subresource-integrity
+  metadata:
+    max-request: 1
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+
+    redirects: true
+    max-redirects: 5
+    stop-at-first-match: false
+    matchers-condition: and
+    matchers:
+      - type: xpath
+        part: body
+        xpath:
+          - "//script[contains(@src,'//') and not(contains(translate(@integrity,'ABCDEFGHIJKLMNOPQRSTUVWXYZ','abcdefghijklmnopqrstuvwxyz'),'^sha'))]"
+
+      - type: word
+        words:
+          - "text/html"
+        part: header
+
+    extractors:
+      - type: xpath
+        attribute: src
+        xpath:
+          - "//script[contains(@src,'//') and not(contains(translate(@integrity,'ABCDEFGHIJKLMNOPQRSTUVWXYZ','abcdefghijklmnopqrstuvwxyz'),'^sha'))]"

From 34663f85ee8c87a6de08f1ac852c50fc124d0aef Mon Sep 17 00:00:00 2001
From: Prince Chaddha <prince@projectdiscovery.io>
Date: Mon, 4 Sep 2023 16:54:46 +0530
Subject: [PATCH 2/3] Update and rename sri-missing.yaml to missing-sri.yaml

---
 .../{sri-missing.yaml => missing-sri.yaml}                 | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)
 rename http/misconfiguration/{sri-missing.yaml => missing-sri.yaml} (90%)

diff --git a/http/misconfiguration/sri-missing.yaml b/http/misconfiguration/missing-sri.yaml
similarity index 90%
rename from http/misconfiguration/sri-missing.yaml
rename to http/misconfiguration/missing-sri.yaml
index 4822c5d404..9e2b7aadd6 100644
--- a/http/misconfiguration/sri-missing.yaml
+++ b/http/misconfiguration/missing-sri.yaml
@@ -1,15 +1,15 @@
-id: sri-missing
+id: missing-sri
 info:
-  name: SRI missing
+  name: Missing Subresource Integrity
   author: lucky0x0d,PulseSecurity.co.nz
   severity: info
-  tags: javascript,subresource integrity
   description: |
      Checks if script tags within the HTML response have Subresource Integrity implemented via the integrity attribute
   reference:
     - https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html#subresource-integrity
   metadata:
     max-request: 1
+  tags: compliance,js,sri
 
 http:
   - raw:
@@ -19,7 +19,6 @@ http:
 
     redirects: true
     max-redirects: 5
-    stop-at-first-match: false
     matchers-condition: and
     matchers:
       - type: xpath

From c0f60f267bb79da3635c6b4a2ffc651d236bb762 Mon Sep 17 00:00:00 2001
From: Prince Chaddha <prince@projectdiscovery.io>
Date: Mon, 4 Sep 2023 16:56:03 +0530
Subject: [PATCH 3/3] adding misconfig tag

---
 http/misconfiguration/missing-sri.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/http/misconfiguration/missing-sri.yaml b/http/misconfiguration/missing-sri.yaml
index 9e2b7aadd6..75d31a0d97 100644
--- a/http/misconfiguration/missing-sri.yaml
+++ b/http/misconfiguration/missing-sri.yaml
@@ -9,7 +9,7 @@ info:
     - https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html#subresource-integrity
   metadata:
     max-request: 1
-  tags: compliance,js,sri
+  tags: compliance,js,sri,misconfig
 
 http:
   - raw: