Import-Map Integrity

WICG Import Maps + Subresource Integrity (SRI) extension. When a page declares " in a module url and breaks out of the tag. res.end(b.importmapIntegrity.scriptTag(im));

b.importmapIntegrity.scriptTag(importmap, opts?) #

{
  nonce:  string,   // CSP nonce added as nonce="…" on the  tag using the  in a module url, so concatenating it into the page lets a  in a url close the element and inject markup — this escapes < > & (and the U+2028 / U+2029 separators) so no url can break out.

res.end(b.importmapIntegrity.scriptTag(im, { nonce: req.cspNonce }));

Last updated 2026-08-08T16:39:49.652Z by seeder.