更换 cdnjs 和 Google Fonts 源 #165
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Switch Google Fonts to official API - Switch CDNJS mirror to Zstatic[.]net - Implement SHA384 SRI hashes for external resources
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
已移除来自
bootcss.com,bootcdn.com,staticfile.net,staticfile.org,cdn.polyfill.io镜像的任何文件引用，这些镜像源已被发现有 篡改文件并插入恶意代码 的行为，可能会导致被跳转至恶意网站。另外，
fonts.loli.net在很早之前就被吊销备案，已没有国内镜像节点，被 GFW 阻断情况非常严重。因此已替换为带有国内节点的
fonts.googleapis.com官方源。另外为了防止再次被供应链攻击，已在外部资源加上基于 SHA384 的哈希验证，确保外部文件不被篡改。