0.4.0-alpha.17 with [vulnerability][acl] Fix #344 Normalize "with" na…

…mespace objects before bound function detection

README.md

@@ -6,6 +6,7 @@
 Thin Hook Preprocessor (experimental)
 
 ## Notes
+- **[Vulnerability Fix]** Since [0.4.0-alpha.17](https://github.com/t2ym/thin-hook/releases/tag/0.4.0-alpha.17) with [Fix #344 Normalize `with` namespace objects before bound function detection](https://github.com/t2ym/thin-hook/issues/344), bound function calls in a `with` clause is properly detected. Prior to this version, ACL for unbound original function is not applied for bound function calls in a `with` clause.
 - **[Vulnerability Fix]** Since [0.4.0-alpha.16](https://github.com/t2ym/thin-hook/releases/tag/0.4.0-alpha.16) with [Fix #342 Chain `acl[S_DEFAULT][S_PROTOTYPE][S_INSTANCE]` to `acl.Object[S_PROTOTYPE][S_INSTANCE]`](https://github.com/t2ym/thin-hook/issues/342), `acl.Object[S_PROTOTYPE][S_INSTANCE]` is applied for anonymous object properties. Prior to this version, `acl.Object[S_PROTOTYPE][S_INSTANCE]` is not applied anonymous object properties.
 - **[Vulnerability Fix]** Since [0.4.0-alpha.15](https://github.com/t2ym/thin-hook/releases/tag/0.4.0-alpha.15) with [Fix #341 Apply ACL to all sources of Object.assign()](https://github.com/t2ym/thin-hook/issues/341), ACL is applied for all sources of `Object.assign()` even they contain falsy values. Prior to this version, ACL is not applied for sources of `Object.assign()` if the first source is not an object like `undefined`.
 - **[Vulnerability Fix]** Since [0.4.0-alpha.13](https://github.com/t2ym/thin-hook/releases/tag/0.4.0-alpha.13) with [Fix #336 Apply ACL for super classes/objects of global classes/objects with no dedicated ACLs](https://github.com/t2ym/thin-hook/issues/336), ACL is applied for super classes/objects of global classes/objects and instances of global classes even without dedicated ACLs. Prior to this version, ACL is not applied for super classes/objects of global classes/objects and instances of global classes without dedicated ACLs.

demo-frontend/components/thin-hook/demo/hook-callback.js

@@ -5327,11 +5327,32 @@ else {
         }
       }
       _f = f;
+      if (newTarget === false) { // resolve the scope in 'with' statement body
+        let varName = _args[0];
+        let __with__ = thisArg;
+        let scope = _global;
+        let _scope;
+        let i;
+        for (i = 0; i < __with__.length; i++) {
+          _scope = __with__[i];
+          if (Reflect.has(_scope, varName)) {
+            if (_scope[Symbol.unscopables] && _scope[Symbol.unscopables][varName]) {
+              continue;
+            }
+            else {
+              scope = _scope;
+              break;
+            }
+          }
+        }
+        thisArg = normalizedThisArg = scope;
+      }
       boundParameters = _boundFunctions.get(f);
       if (!boundParameters) {
         switch (f) {
         case '()':
         case '#()':
+        case 'w()':
           switch (typeof thisArg) {
           case 'function':
             switch (_args[0]) {
@@ -5428,26 +5449,6 @@ else {
         }
         */
         // property access
-        if (newTarget === false) { // resolve the scope in 'with' statement body
-          let varName = _args[0];
-          let __with__ = thisArg;
-          let scope = _global;
-          let _scope;
-          let i;
-          for (i = 0; i < __with__.length; i++) {
-            _scope = __with__[i];
-            if (Reflect.has(_scope, varName)) {
-              if (_scope[Symbol.unscopables] && _scope[Symbol.unscopables][varName]) {
-                continue;
-              }
-              else {
-                scope = _scope;
-                break;
-              }
-            }
-          }
-          thisArg = normalizedThisArg = scope;
-        }
         if (boundParameters) {
           normalizedThisArg = boundParameters._normalizedThisArg;
           _args = [ boundParameters._f, boundParameters._args.concat(_args) ];
@@ -6843,11 +6844,32 @@ else {
         }
       }
       _f = f;
+      if (newTarget === false) { // resolve the scope in 'with' statement body
+        let varName = _args[0];
+        let __with__ = thisArg;
+        let scope = _global;
+        let _scope;
+        let i;
+        for (i = 0; i < __with__.length; i++) {
+          _scope = __with__[i];
+          if (Reflect.has(_scope, varName)) {
+            if (_scope[Symbol.unscopables] && _scope[Symbol.unscopables][varName]) {
+              continue;
+            }
+            else {
+              scope = _scope;
+              break;
+            }
+          }
+        }
+        thisArg = normalizedThisArg = scope;
+      }
       boundParameters = _boundFunctions.get(f);
       if (!boundParameters) {
         switch (f) {
         case '()':
         case '#()':
+        case 'w()':
           switch (typeof thisArg) {
           case 'function':
             switch (_args[0]) {
@@ -6944,26 +6966,6 @@ else {
         }
         */
         // property access
-        if (newTarget === false) { // resolve the scope in 'with' statement body
-          let varName = _args[0];
-          let __with__ = thisArg;
-          let scope = _global;
-          let _scope;
-          let i;
-          for (i = 0; i < __with__.length; i++) {
-            _scope = __with__[i];
-            if (Reflect.has(_scope, varName)) {
-              if (_scope[Symbol.unscopables] && _scope[Symbol.unscopables][varName]) {
-                continue;
-              }
-              else {
-                scope = _scope;
-                break;
-              }
-            }
-          }
-          thisArg = normalizedThisArg = scope;
-        }
         if (boundParameters) {
           normalizedThisArg = boundParameters._normalizedThisArg;
           _args = [ boundParameters._f, boundParameters._args.concat(_args) ];

demo-frontend/components/thin-hook/demo/index.html

@@ -15,9 +15,9 @@
 <html lang="en">
 <head>
   <meta charset="utf-8">
-  <script integrity="sha256-YH6wtDKy5nChF42Ak5+KIM32ViQIs0qe40TZlShvk4g= sha256-oh4tzMCRHudm3X970xV4zEKK0kHqzLS/a2XOFdHGMoI=" src="../../thin-hook/hook.min.js?version=668&no-hook-authorization=cdc63380056da4371d34c1b70c8b9fd83f66747762836c139091186ec0ab796d,a578e741369d927f693fedc88c75b1a90f1a79465e2bb9774a3f68ffc6e011e6,log-no-hook-authorization&sw-root=/&no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&service-worker-ready=false"></script></head></html>
-  <script context-generator src="no-hook-authorization.js?no-hook=true" integrity="sha256-zcYzgAVtpDcdNMG3DIuf2D9mdHdig2wTkJEYbsCreW0="></script>
-  <script context-generator src="integrity.js?no-hook=true" integrity="sha256-WeVuychu3svkyCWfeOEVolUmEpZlkrNabuEIMn9yR04="></script>
+  <script integrity="sha256-3ygk5Y/29p1JpPqjUAwMCpXoGyHWmCBhF26tusBvH9I= sha256-EFTEcKkq9CglVKpKhoOHqJfgh0rO+VrZBU5UftvVp9A=" src="../../thin-hook/hook.min.js?version=668&no-hook-authorization=0ad710f36c82f8f7f181179788b80c4b4d58dd942d7a6961bb8a6b117c022196,a578e741369d927f693fedc88c75b1a90f1a79465e2bb9774a3f68ffc6e011e6,log-no-hook-authorization&sw-root=/&no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&service-worker-ready=false"></script></head></html>
+  <script context-generator src="no-hook-authorization.js?no-hook=true" integrity="sha256-CtcQ82yC+PfxgReXiLgMS01Y3ZQtemlhu4prEXwCIZY="></script>
+  <script context-generator src="integrity.js?no-hook=true" integrity="sha256-yyigczBXPux9bplccX/JKpARkhJNCOKUTwM05RbrTgE="></script>
   <script context-generator src="disable-devtools.js?no-hook=true" integrity="sha256-qBIJIoIJlBCXrEHFvaO8HNZDdeabfIETr/aML+Zyn/I="></script>
   <script context-generator src="context-generator.js?no-hook=true" integrity="sha256-Q3SuHyjOwrlpq0iIlaQmYkTWXijh+Cco/SzTkTD+DZ4="></script>
   <script context-generator src="bootstrap.js?no-hook=true" integrity="sha256-TqPlk5mugojW8S5owdMaeSZi4Sw/xmbQjb39/JFLAJE="></script>
@@ -49,8 +49,8 @@
     };
   }
   </script>
-  <script context-generator src="cache-bundle.js?no-hook=true&authorization=0bc93aad90eeea47a29cfef997737201577d62c4879e0949f4d3e51f1aaec800" integrity="sha256-xZ1Ebqkx3yhzbVhtwmh3Mdrbczw8/WRMffOvs2pq45o="></script>
-  <script src="hook-callback.js?no-hook=true" integrity="sha256-HnCiuvU9KlBzMCMrp0Z2LvSwWV2kNru8rybLoxuERU0="></script>
+  <script context-generator src="cache-bundle.js?no-hook=true&authorization=9222ec77836655930b9cf179c732114cabca07b48e052127341542806e367ba5" integrity="sha256-xZ1Ebqkx3yhzbVhtwmh3Mdrbczw8/WRMffOvs2pq45o="></script>
+  <script src="hook-callback.js?no-hook=true" integrity="sha256-N8IZf4JIg+kl4Q6sNqhZNWrJW40x6t/pZjsf/lhMeFk="></script>
   <script context-generator src="script-hashes.js?no-hook=true&service-worker-ready=false" integrity="sha256-ugdlTRwkonG6D6fuXFXNYMAhM7DlPLa7bmNNpHOx5UA= sha256-DteoIEQQ1mutKCjqyrYXSzKRp26scMUVeZS+7SjyUhQ="></script><!--<C!-- end of mandatory no-hook scripts --C>
   <script src="../../webcomponentsjs/webcomponents-lite.js"></script>
   <C!-- <script no-hook>

demo-frontend/components/thin-hook/demo/integrity.js

@@ -331,8 +331,8 @@
 
   RSA.publicKeyBits = 2048; // number of bits in RSA public key, which must be at least 2048
   RSA.publicKeySize = RSA.publicKeyBits / 8; // number of bytes for RSA-OAEP encrypted data size
-  RSA.publicKeyBase64 = 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvhfKwFBexkw+aoMwAt6kMk+wQUDhInCLcJAg7DrqoirqGcKeU1uswWMcm1b7aoZIcZbtN3OSjn0UyxiuiYaacK8s+uFQhjICXqcXmDqcjkXih87lah+jgJMoYaATvmphwNREaLTRvuXp4Dk5/Elv57cmTC0Ku9Ll2l9tszziHO82eTa6vFRQlVUc+BoM/dEJZOm782T1RvMfg0K5F7jpCOOv/s7fgW/jdvJ4SQxOxl1jDsFtD8Wxa7OUGqowDFWzGoz6B3HRYDfHKNgdd0WPXGFue/E6X72UeS+6037fDVC7KD6fUBsqxTYZAvY8G6JSXVrmAAA8k+ST5AUxTwHXjQIDAQAB';
-  ECDSA.publicKeyBase64 = 'MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEyDk0oyw4ZTFjaZR+w0WNK9fz124eP4yo+Yp1gpAN+l3VgYHZ6w4I1K1uzNGlpYBhDpkoToAhl+95yot0YDJoIw==';
+  RSA.publicKeyBase64 = 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtuJTX/EzmSVCSQj8zac8sugZTqDT5so4qSYKYYOSiidWqaXQAaqVrJ9qBpX3KH1JHPFf0ov7H8yy5QG+76Fr7vkm83PL1P4tmuDeaQZQPzOrrv0GsWAb+L8vcvN9DkhzjBK+qXihV8wjdm0llhEAhpeUp5bLxE4IFCXZEYLTZ2MJrOu9jp4ENQFfiw+q1dsTvFOA/26R4Xy3xm7C37lodyJQV9GatZrnSEE+fjHNPb2V0n1Q9LJW7loH/ECeJg3ZR/MloE5tDJDEunst0m0IRKa9MxyKom+ClEqupLtbaLkaKqznB1fA4XiDPVfvzlwR68t2db4BGz2fxb6eyASRHwIDAQAB';
+  ECDSA.publicKeyBase64 = 'MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECLSLGjpwwXdtafD8PWYwiKFHKxZbXDi3Jq6TY9b/DZ5fRzbnNNJMvvslfrE17em79Tou15BCh1NkM7BisaaHNQ==';
   ECDSA.signatureLength = SHA256.hashBytes * 2;
   ECDHE.publicKeyLength = 1 + SHA256.hashBytes * 2;
 

demo-frontend/components/thin-hook/demo/integrity.json

@@ -3494,13 +3494,13 @@
   "/components/thin-hook/demo/bundle.json": "NKwjN4DXt2s+80XoHlFlWbnI5rklchdQCerPDjtfBIk=",
   "/components/thin-hook/demo/cache-automation.js": "x2G0JD1JJOVC3rhFCrQnigaYlTu7C5vhOTRHBixXcS4=",
   "/components/thin-hook/demo/cache-bundle.js": "xZ1Ebqkx3yhzbVhtwmh3Mdrbczw8/WRMffOvs2pq45o=",
-  "/components/thin-hook/demo/cache-bundle.json": "L1pNghc7Kf6H6nkXV6rbhH37PQd2/VlFLVgnp+Br+vg=",
+  "/components/thin-hook/demo/cache-bundle.json": "AASj27edGMEx4Q+OZ2byZnAuPwl6rj6aWnzsvssKx1M=",
   "/components/thin-hook/demo/commonjs.js": "KjmEtrrjEj4WCR1bjCEOZnXhe+9w4wJoaUg40WU0FuQ=",
   "/components/thin-hook/demo/commonjs2.js": "tiHpF2aP1nZUY/O31R9j/kWne3jFgqPIds0MwNLxhk4=",
   "/components/thin-hook/demo/content-loader.js": "AkIBbiiHsyKrKLiH8Dd5xjiZ2yMrsDbXlKAnjbnlQzk=",
   "/components/thin-hook/demo/context-generator.js": "Q3SuHyjOwrlpq0iIlaQmYkTWXijh+Cco/SzTkTD+DZ4=",
   "/components/thin-hook/demo/disable-devtools.js": "qBIJIoIJlBCXrEHFvaO8HNZDdeabfIETr/aML+Zyn/I=",
-  "/components/thin-hook/demo/empty-document.html": "cA/iTA2FmHOaZEXt7ASesNZ8td06+y8Tnq4TQR0RKYI=",
+  "/components/thin-hook/demo/empty-document.html": "2BVG5tolIe4iYNqQzNOhzypWNamSa3Q3rfTzV1p7cbM=",
   "/components/thin-hook/demo/es6-module.js": "fqNv9zHgC8txL7mU0+zySAwIQNRjpTVJtDI34AWzvOY=",
   "/components/thin-hook/demo/es6-module2.js": "m8es06TrC+X9xZ9p6bWrs0s4su7FcMoZak389t8NOyY=",
   "/components/thin-hook/demo/es6-module3.js": "qq7q9Gk9vgQSZmElUAaLOEQxALCbP9ysHKqQjwyas+Y=",
@@ -3510,12 +3510,12 @@
   "/components/thin-hook/demo/generator.js": "KN5sn0Eo8OgAJbr5mDlBfbNkZMI6r7/2qn0L77tqGJo=",
   "/components/thin-hook/demo/global.js": "pSw50DEF5s1Mvna1jemHFHdyV0mKgEjjK6WUa4gnPis=",
   "/components/thin-hook/demo/gulpfile.js": "DIqA08HOMy17CgdY4ZDisJbNGxMPcP3YXTGz2eijReY=",
-  "/components/thin-hook/demo/hook-callback.js": "HnCiuvU9KlBzMCMrp0Z2LvSwWV2kNru8rybLoxuERU0=",
+  "/components/thin-hook/demo/hook-callback.js": "N8IZf4JIg+kl4Q6sNqhZNWrJW40x6t/pZjsf/lhMeFk=",
   "/components/thin-hook/demo/hook-native-api.js": "CXlkZoO+ybloLZdNVJ7/thsfyYGth9rHbUTQRA2Hs5Y=",
   "/components/thin-hook/demo/hook-worker.js": "W2FaqIWgUYRmFTvm7LLP7vEwDxgf9gypHK2WRlnJIFI=",
   "/components/thin-hook/demo/index-fb.html": "D9idm83/VxddYcF1L/fb3Vu6W5n8IDX4lH5KG66DSFk=",
   "/components/thin-hook/demo/inline-script.svg": "NRdobFKL9ufnJCuVHoPLUUsXRBgGgjY3EdwWwHjm/GQ=",
-  "/components/thin-hook/demo/integrity.js": "WeVuychu3svkyCWfeOEVolUmEpZlkrNabuEIMn9yR04=",
+  "/components/thin-hook/demo/integrity.js": "yyigczBXPux9bplccX/JKpARkhJNCOKUTwM05RbrTgE=",
   "/components/thin-hook/demo/invalid-document.html": "KAPziibQgBjvjZ6VlnXTeFUTkAuZVpd3BtX0pBKBzzI=",
   "/components/thin-hook/demo/lhs.js": "h12n3evI8zqX4nFe66ZlwpbdwgB/o8YZJjkxFVPVOIQ=",
   "/components/thin-hook/demo/locales/bundle.de.json": "yBx145NiuX8NYTjr4YnQDauqpPg2forcuXjFqtzYq70=",
@@ -3551,14 +3551,14 @@
   "/components/thin-hook/demo/my-view2.json": "PptwWPvugpMTpsXZFfaSVwr2BcYSGJkfhjEiV6RrFJI=",
   "/components/thin-hook/demo/my-view3.html": "pSmI7cALKmeqoKKZefU8NicI4V0ZUcScMGSklkVBeFw=",
   "/components/thin-hook/demo/my-view3.json": "uatxD9AZkiGiFvGsMqhTVLNxAqDiylbvuGors1Hb1hc=",
-  "/components/thin-hook/demo/no-hook-authorization.js": "zcYzgAVtpDcdNMG3DIuf2D9mdHdig2wTkJEYbsCreW0=",
-  "/components/thin-hook/demo/normalize.js": "FrLdkW413ozVgjrZCctivQqirf0reF84pM176vInIFc=",
+  "/components/thin-hook/demo/no-hook-authorization.js": "CtcQ82yC+PfxgReXiLgMS01Y3ZQtemlhu4prEXwCIZY=",
+  "/components/thin-hook/demo/normalize.js": "TuCxYQ3r4JTKL3fvv6mhW9Er7yG/7We9gE1l/JnprG4=",
   "/components/thin-hook/demo/script-hashes.js": "ugdlTRwkonG6D6fuXFXNYMAhM7DlPLa7bmNNpHOx5UA=",
   "/components/thin-hook/demo/shared-worker-client.js": "WE5mA1PRKWU5fULLeEqjSJ5RpFF3uf4fWyvNkGK83D0=",
   "/components/thin-hook/demo/shared-worker.js": "B9AZYCwUFTYmnEXQ0hLA6JJbVR5vakBrX3426XaEbbI=",
   "/components/thin-hook/demo/spread.js": "gpfCZwAb/tn4HErIHzwhcCC0eMbvuzExYzK97dlma2A=",
-  "/components/thin-hook/demo/sub-document.html": "C0RtxyLITSRruSn2deEpEeTyDk6UvOYjybUqsM5cS90=",
-  "/components/thin-hook/demo/sub-sub-document.html": "Mewh10yhtyJf/a/r4vSSyzp+4exycovUlZ4/m7I/WPc=",
+  "/components/thin-hook/demo/sub-document.html": "OrDj1LwuTLCOyrHaTRQvZzbzKBtAdOoTiAsFB7vVGiE=",
+  "/components/thin-hook/demo/sub-sub-document.html": "ot8KqxRLraU8OviNLv+qcmFFHDZxruOt9vA4NdLHU1k=",
   "/components/thin-hook/demo/unauthorized-no-hook-script.js": "YjNcphHrG7UkmBspO6aCgkw+hh4Y7XvsD4TmuplpABE=",
   "/components/thin-hook/demo/unauthorized-no-hook-worker-script.js": "j5e2u8zJ41kNLbACDJCY/DJkneDOzuWJwZ+lw2bh1XE=",
   "/components/thin-hook/demo/web-worker-client.js": "stBjyffqLegDpNIyI3pc9q3H0lmL961LWhGr0eR5N/0=",
@@ -3573,7 +3573,7 @@
   "/components/thin-hook/demo/xliff/bundle.fr.xlf": "qC940/MZ/rG31gok/D9KPHYD/xRCkziCBIUwhgxdovI=",
   "/components/thin-hook/demo/xliff/bundle.ja.xlf": "QbZEDWcoqnJyqKIHA8rGr7rNYmG67RAHOyw1/oEXWu8=",
   "/components/thin-hook/demo/xliff/bundle.zh-Hans.xlf": "AyxbV4426iZK9PQB6O+s3JIoA3sO+4lVOQlSrwP7+/U=",
-  "/components/thin-hook/hook.min.js": "YH6wtDKy5nChF42Ak5+KIM32ViQIs0qe40TZlShvk4g=",
+  "/components/thin-hook/hook.min.js": "3ygk5Y/29p1JpPqjUAwMCpXoGyHWmCBhF26tusBvH9I=",
   "/components/vaadin-grid/all-imports.html": "LMCPxNwxFswTTdXlEHbdRxOpL5SpqCPSHCLSit7xLw0=",
   "/components/vaadin-grid/bower.json": "0nox4NkE51Wy3KhWPvlJ7leWO6MhyCx6utOGLMOCBxA=",
   "/components/vaadin-grid/grid.gif": "bYmTEFtW4rCFnHX6m7k0XnOBHnVBsgAs4WEPiEoy4dc=",

demo-frontend/components/thin-hook/demo/no-hook-authorization.js

@@ -13,11 +13,11 @@ else {
     //   hook.parameters.noHookAuthorizationFailed
     // JSONs are output to console in the learning mode
     //'*': true, 
-    "607eb0b432b2e670a1178d80939f8a20cdf6562408b34a9ee344d995286f9388": true, // hook.min.js
+    "df2824e58ff6f69d49a4faa3500c0c0a95e81b21d6982061176eadbac06f1fd2": true, // hook.min.js
     "a81209228209941097ac41c5bda3bc1cd64375e69b7c8113aff68c2fe6729ff2": true, // demo/disable-devtools.js
     "4374ae1f28cec2b969ab488895a4266244d65e28e1f82728fd2cd39130fe0d9e": true, // demo/context-generator.js
     "4ea3e59399ae8288d6f12e68c1d31a792662e12c3fc666d08dbdfdfc914b0091": true, // demo/bootstrap.js
-    "1e70a2baf53d2a507330232ba746762ef4b0595da436bbbcaf26cba31b84454d": true, // demo/hook-callback.js
+    "37c2197f824883e925e10eac36a859356ac95b8d31eadfe9663b1ffe584c7859": true, // demo/hook-callback.js
     "0979646683bec9b9682d974d549effb61b1fc981ad87dac76d44d0440d87b396": true, // demo/hook-native-api.js
     "5b615aa885a0518466153be6ecb2cfeef1300f181ff60ca91cad964659c92052": true, // demo/hook-worker.js
     "c59d446ea931df28736d586dc2687731dadb733c3cfd644c7df3afb36a6ae39a": true, // demo/cache-bundle.js
@@ -33,7 +33,7 @@ else {
     "c135fd6ba3cad41e63985ecca191995bf311abc756c5f574ef5b641e7db56914": true, // (function writeln2() { console.log("no-hook script tag via document.writeln"); })()
     "e233738578fd7e8f2e961fb11885e2c187146314a8e3fc65692633ff89c5d34a": true, // (function writeln4() { console.log("no-hook script tag in div tag via document.writeln"); })()
     "4f0395d52a8c1c7edaacacade9c31fe18555b79ce963dfb1abaaa34990993374": true, // location = "about:blank";
-    "59e56ec9c86edecbe4c8259f78e115a2552612966592b35a6ee108327f72474e": true, // demo/integrity.js
+    "cb28a07330573eec7d6e995c717fc92a901192124d08e2944f0334e516eb4e01": true, // demo/integrity.js
     "ba07654d1c24a271ba0fa7ee5c55cd60c02133b0e53cb6bb6e634da473b1e540": true, // demo/script-hashes.js
     "0242016e2887b322ab28b887f03779c63899db232bb036d794a0278db9e54339": true, // demo/content-loader.js
   };