cypress: Cypress cannot test sites that implement SRI

I ran into this issue, seemingly out of the blue. I added the following to a script a the top of the document, and it seems to work:

if (window.Cypress) {
const MutationObserver = window.MutationObserver || window.WebKitMutationObserver;
if (MutationObserver) {
  new MutationObserver(function(mutations) {
    mutations.forEach(function(mutation) {
      mutation.addedNodes.forEach(processNode);
    });
  }).observe(document, { childList: true, subtree: true });
}

const processNode = function(node) {
  const tagName = (node.tagName || '').toLowerCase();
  if (
    tagName === 'script'
    && node.integrity
  ) {
    node.onerror = function(e) {
	const fb = document.createElement(tagName);
	const parent = node.parentNode;
	if (node.src) fb.setAttribute('src', node.getAttribute('src'));
	parent.appendChild(fb);
	node.remove();
    };
  }
};
}

This is something that we will fix when #1467 is implemented.

There is a WIP PR for this: #5273

This fix is available starting in 4.6.0 as an experiment which you can access by setting this config option in your cypress.json or elsewhere:

{
	"experimentalSourceRewriting": true
}

The fix is experimental, so there may be some situations where the this is not fixed.

If you’re still this issue while setting the experimentalSourceRewriting to true in 4.6.0 - open a new issue with a reproducible example + screenshots, etc - filling out our issue template.

Confirmed, we have the same problem.

The code for this is done in cypress-io/cypress#5273, but has yet to be released. We’ll update this issue and reference the changelog when it’s released.

Just added this in #5273. Once released, SRI integrity attributes in script tags <script type="text/javascript"> will be rewritten to cypress:stripped-integrity attributes.

<script type="text/javascript" integrity="foo">

becomes the below which will cause integrity checking to be skipped.

<script type="text/javascript" cypress:stripped-integrity="foo">