From 1805a870c9de1f881a9cdd00575b1c15f63bba65 Mon Sep 17 00:00:00 2001 From: Ken Date: Wed, 27 May 2026 07:10:19 +0000 Subject: [PATCH] feat: publish "A Compromised Server Can't Inject Code" (Cloudpack series #6) --- .../a-compromised-server-cant-inject-code.md | 202 ++++++++++++++++++ 1 file changed, 202 insertions(+) create mode 100644 src/content/posts/a-compromised-server-cant-inject-code.md diff --git a/src/content/posts/a-compromised-server-cant-inject-code.md b/src/content/posts/a-compromised-server-cant-inject-code.md new file mode 100644 index 0000000..4b44e35 --- /dev/null +++ b/src/content/posts/a-compromised-server-cant-inject-code.md @@ -0,0 +1,202 @@ +--- +title: "A Compromised Server Can't Inject Code" +date: 2026-05-28 +type: post +tags: [bundler, security, signing, cloudpack, threat-model] +summary: "The manifest server tells browsers which chunks to fetch. If an attacker owns it, they can redirect to existing content-hashed chunks. They can't inject new code. The signature covers the chunk hashes, not the advisory fields." +--- + +Suppose an attacker compromises the manifest server. They have full control: they can rewrite every response, change every URL, serve whatever JSON they want. + +What can they do? They can tell browsers to fetch different content-hashed chunks from the CDN. Chunks that already exist. Chunks that were produced by legitimate builds. + +What can't they do? They can't inject new JavaScript. They can't create a chunk that doesn't already exist on the CDN. They can't modify a chunk's contents without invalidating its content hash. And they can't forge the ed25519 signature that covers those hashes. + +This is the security property that the entire Adaptive Bundle Service is designed around. The manifest server is not trusted with code. It is trusted with *routing*. And routing to existing, signed, content-hashed artifacts is a smaller attack surface than serving arbitrary content. + +## The industry default + +Most web applications rely on two mechanisms for delivery integrity: HTTPS between CDN and browser, and Subresource Integrity (SRI) attributes in HTML. + +HTTPS prevents a network attacker from modifying content in transit. It does nothing if the server itself is compromised. SRI hashes are embedded in `