0.4.0-alpha.24 with [Vulnerability] Fix #368 Check Service Worker cac…

…he integrity with HMAC
t2ym · Jul 31, 2020 · fa09c38 · fa09c38
1 parent 9d3e340
commit fa09c38
Show file tree

Hide file tree

Showing 26 changed files with 255 additions and 92 deletions.
diff --git a/demo-frontend/components/thin-hook/demo/cache-bundle.json b/demo-frontend/components/thin-hook/demo/cache-bundle.json
diff --git a/demo-frontend/components/thin-hook/demo/cache-bundle.json.gz b/demo-frontend/components/thin-hook/demo/cache-bundle.json.gz
diff --git a/demo-frontend/components/thin-hook/demo/index.html b/demo-frontend/components/thin-hook/demo/index.html
@@ -15,9 +15,9 @@
 <html lang="en">
 <head>
   <meta charset="utf-8">
-  <script integrity="sha256-KvMTtwLiRbnOTiN1dk/CeIAGyhlmJPiRcfFdcIjolDo= sha256-goYzYce2cetHxjSOOtWedB1cwTXTkyzxaBzGYj63+dI=" src="../../thin-hook/hook.min.js?version=668&no-hook-authorization=92c2c443421e9dee9c0c3f63eadd32e485289919fe238b0c632413de05077cc8,a578e741369d927f693fedc88c75b1a90f1a79465e2bb9774a3f68ffc6e011e6,log-no-hook-authorization&sw-root=/&no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&service-worker-ready=false"></script></head></html>
-  <script context-generator src="no-hook-authorization.js?no-hook=true" integrity="sha256-ksLEQ0Iene6cDD9j6t0y5IUomRn+I4sMYyQT3gUHfMg="></script>
-  <script context-generator src="integrity.js?no-hook=true" integrity="sha256-4BWd+l0MfGDu6boBh7igO0aMBE92hOVpF+KQTfhkhH4="></script>
+  <script integrity="sha256-XwXi6pXmieY8gi1LSrcZ4kGBc+hiO8L+KpxqIl0XnVU= sha256-RPI36aqE0+j2qfTmLGSUJocKTfZzWRuv/nusUbLqgAY=" src="../../thin-hook/hook.min.js?version=668&no-hook-authorization=f572a2084e1f6aaa6beb71978e8ee3d4226a2b80cf32e6bb650ce235216e4329,a578e741369d927f693fedc88c75b1a90f1a79465e2bb9774a3f68ffc6e011e6,log-no-hook-authorization&sw-root=/&no-hook=true&hook-name=__hook__&context-generator-name=method&discard-hook-errors=false&fallback-page=index-fb.html&hook-property=true&hook-global=true&hook-prefix=_uNpREdiC4aB1e_&compact=true&service-worker-ready=false"></script></head></html>
+  <script context-generator src="no-hook-authorization.js?no-hook=true" integrity="sha256-9XKiCE4faqpr63GXjo7j1CJqK4DPMua7ZQziNSFuQyk="></script>
+  <script context-generator src="integrity.js?no-hook=true" integrity="sha256-GL7l3X+inLlYpXU34DiWR9Jz7cKUXdCjxisbIv5s5KE="></script>
   <script context-generator src="disable-devtools.js?no-hook=true" integrity="sha256-qBIJIoIJlBCXrEHFvaO8HNZDdeabfIETr/aML+Zyn/I="></script>
   <script context-generator src="context-generator.js?no-hook=true" integrity="sha256-Q3SuHyjOwrlpq0iIlaQmYkTWXijh+Cco/SzTkTD+DZ4="></script>
   <script context-generator src="bootstrap.js?no-hook=true" integrity="sha256-HufxR5bDjMotWrEuwQ1M44nIv6OxHleQXlXx4/3O2RQ="></script>
@@ -49,7 +49,7 @@
     };
   }
   </script>
-  <script context-generator src="cache-bundle.js?no-hook=true&authorization=74112f5cacb3b29d7b0ea04e26e70a2fb3fbe178037948de9f511e24dd6608d8" integrity="sha256-xZ1Ebqkx3yhzbVhtwmh3Mdrbczw8/WRMffOvs2pq45o="></script>
+  <script context-generator src="cache-bundle.js?no-hook=true&authorization=677f24b922141ed4e9d4734513136cac80ba0425db672c69b0ba182b3c12bce4" integrity="sha256-xZ1Ebqkx3yhzbVhtwmh3Mdrbczw8/WRMffOvs2pq45o="></script>
   <script src="hook-callback.js?no-hook=true" integrity="sha256-tz9m8NV/pCoUQxknebU4e2kmRewnqKaUPAwGWq/FhZ0="></script>
   <script context-generator src="script-hashes.js?no-hook=true&service-worker-ready=false" integrity="sha256-ugdlTRwkonG6D6fuXFXNYMAhM7DlPLa7bmNNpHOx5UA= sha256-DteoIEQQ1mutKCjqyrYXSzKRp26scMUVeZS+7SjyUhQ="></script><!--<C!-- end of mandatory no-hook scripts --C>
   <script src="../../webcomponentsjs/webcomponents-lite.js"></script>

diff --git a/demo-frontend/components/thin-hook/demo/integrity.js b/demo-frontend/components/thin-hook/demo/integrity.js
@@ -256,6 +256,7 @@
   });
 
   const INTEGRITY_PSEUDO_URL = 'https://thin-hook.localhost.localdomain/integrity.json';
+  const CACHE_STATUS_PSEUDO_URL = 'https://thin-hook.localhost.localdomain/cache-status.json';
 
   let Sessions = [];
   let CurrentSession;
@@ -331,8 +332,8 @@
 
   RSA.publicKeyBits = 2048; // number of bits in RSA public key, which must be at least 2048
   RSA.publicKeySize = RSA.publicKeyBits / 8; // number of bytes for RSA-OAEP encrypted data size
-  RSA.publicKeyBase64 = 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6A/ncwT+Dm6sfbT+36b181tjfCZGZ4X0LtJrCnEKjXiWHkpuUUHfw0IVSUD4tVl+WMsJ7SYXdPzgRZkNLZ2iMo3L9V7+Cctl0ZBQXgs0NVRRQlkOtEUZiOjWcdIILbWoEx62Z8A9VoHI1+hIHbZ6Fx7yGNLjE0E5Dq5caht1RzWS/u+E9aK+qlC1zkG7Rcrvd48HYBp6j6ie2NJ6c62F9U4oBsEg5GEZzS2hjq0LhANNEbdR5ccTKAFs4ocYPjeg6YDQz0zqJJZHshXMB4NY79VpRa5sAKkUY/Ra/PDoi5Ugl7A2j8AdQX9Pg9ASARVAzcUp2Cqd0VqiRl2dQn/CXQIDAQAB';
-  ECDSA.publicKeyBase64 = 'MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEGoVCwPI1JTuoUOUodJ1NWtm/lPZD82qEqNoLvcxcRrnD4zxBomZsonIlxFueKg0wIOdXAzD1bCeFP6EyQ3OloA==';
+  RSA.publicKeyBase64 = 'MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAj/QNzjbD+ylTvVPOhoZEbdKPhkjXuNKTk2SIBT+QKnKDe3W2zm8UlLPusKhXdnOobkmR9La4VG2M3xNtAKJOO7NTGp94PnGKdE+wSr0iW3+cEQ0n7OFwyt0EgtrbJJsX7KH2RbUKCsr9gkfq56NlkyHj9ftNXc8pzgjdP+6SL0B9xglzihYEjymqnopl7IMb/Nl4yBvwydgNO4FFdsghDcXKidDqkbJtWWIF7BMs7O/w37s/vJtgp7eunqu8X3LFRcOFlAVbgHeP/vkDKszURu4QHe5ihnspkqIg5rAZm4+75DBq31VRL3ulNEagvl9jPQeHgg7nHJ4V0UyXXngMkQIDAQAB';
+  ECDSA.publicKeyBase64 = 'MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAESSfzQqieZSN4TlI/1Xu2SR7OMMSznN+1b92BgtdRUeI8j8bzVotEZ+ELx9okN0AKq74sWsWkWO9UC7QuxhgFvA==';
   ECDSA.signatureLength = SHA256.hashBytes * 2;
   ECDHE.publicKeyLength = 1 + SHA256.hashBytes * 2;
 
@@ -989,6 +990,123 @@
     }
   }
 
+  if ((self.constructor.name === 'Window' && top === window) || self.constructor.name === 'ServiceWorkerGlobalScope') {
+    // main document or Service Worker
+    if (self.Cache) {
+      const native = {
+        match: Object.getOwnPropertyDescriptor(self.Cache.prototype, 'match'),
+        put: Object.getOwnPropertyDescriptor(self.Cache.prototype, 'put'),
+      };
+      const Response = self.Response;
+      Object.defineProperty(self.Cache.prototype, 'put', {
+        configurable: false,
+        enumerable: native.put.enumerable,
+        writable: false,
+        value: async function put(request, response) {
+          if (response instanceof Response) {
+            let InitialSession = Sessions[0];
+            let immutableHeaders = false;
+            let headers = response.headers;
+            let headerText = '';
+            let headerNames = [];
+            let digest;
+            let timestamp = Date.now() + '';
+            let random;
+            let body;
+            let contentType = headers.get('content-type');
+            headerText += 'content-type: ' + contentType + '\n';
+            headerNames.push('content-type');
+            try {
+              headers.append('x-cache-timestamp', timestamp);
+            }
+            catch (e) {
+              // immutable headers
+              immutableHeaders = true;
+              headers = new Headers();
+              for (let [key, value] of response.headers) {
+                headers.append(key, value);
+              }
+              headers.append('x-cache-timestamp', timestamp);
+            }
+            headerNames.push('x-cache-timestamp');
+            headerText += 'x-cache-timestamp: ' + timestamp + '\n';
+            body = await response.clone().arrayBuffer();
+            digest = SHA256.prefix + toBase64(await crypto.subtle.digest({ name: SHA256.hashName }, body));
+            headers.append('x-cache-digest', digest);
+            headerNames.push('x-cache-digest');
+            headerText += 'x-cache-digest: ' + digest + '\n';
+            if (InitialSession && InitialSession.initialRandom) {
+              random = toBase64(InitialSession.initialRandom);
+              headers.append('x-cache-random', random);
+              headerNames.push('x-cache-random');
+              headerText += 'x-cache-random: ' + random + '\n';
+            }
+            if (InitialSession && InitialSession.initialSaltKey) {
+              let hmac = HMAC.prefix + toBase64(await crypto.subtle.sign({ name: 'HMAC' }, InitialSession.initialSaltKey, encoder.encode(headerText)));
+              headers.append('x-cache-integrity', headerNames.join(',') + ';' + hmac);
+            }
+            if (immutableHeaders) {
+              response = new Response(response.body, { status: response.status, statusText: response.statusText, headers: headers });
+            }
+          }
+          return native.put.value.call(this, request, response);
+        },
+      });
+      Object.defineProperty(self.Cache.prototype, 'match', {
+        configurable: false,
+        enumerable: native.match.enumerable,
+        writable: false,
+        value: async function match(request, options) {
+          let response = await native.match.value.call(this, request, options);
+          if (response instanceof Response) {
+            let InitialSession = Sessions[0];
+            let headers = response.headers;
+            let body = await response.clone().arrayBuffer();
+            let bodyDigest = SHA256.prefix + toBase64(await crypto.subtle.digest({ name: SHA256.hashName }, body));
+            let isBodyDigestMatching;
+            isBodyDigestMatching = headers.get('x-cache-digest') === bodyDigest;
+            let integrityHeader = headers.get('x-cache-integrity');
+            let isIntegrityHeaderMatching = false;
+            let parts, headerNames, headerHmac, headerText, headerArrayBuffer, signatureBinaryString, signature;
+            if (InitialSession && InitialSession.initialSaltKey && integrityHeader) {
+              parts = integrityHeader.split(';');
+              headerNames = parts[0].split(',');
+              if (parts[1] && parts[1].indexOf(HMAC.prefix) === 0) {
+                headerHmac = parts[1].substring(HMAC.prefix.length);
+                headerText = headerNames.map((headerName) => headerName + ': ' + headers.get(headerName) + '\n').join('');
+                headerArrayBuffer = encoder.encode(headerText);
+                signatureBinaryString = atob(headerHmac);
+                signature = Uint8Array.from(signatureBinaryString, c => c.charCodeAt(0)).buffer;
+                isIntegrityHeaderMatching = await crypto.subtle.verify(
+                    {
+                      name: 'HMAC',
+                    },
+                    InitialSession.initialSaltKey,
+                    signature,
+                    headerArrayBuffer
+                  );
+              }
+            }
+            if (!(isBodyDigestMatching && isIntegrityHeaderMatching)) {
+              let url = typeof request === 'string' ? request : request.url;
+              if (url !== CACHE_STATUS_PSEUDO_URL) {
+                console.error('Cache.match: integrity check failed for ' + url);
+                response = undefined;
+              }
+              else {
+                if (!isBodyDigestMatching) {
+                  console.error('Cache.match: integrity check failed for ' + url);
+                  response = undefined;
+                }
+              }
+            }
+          }
+          return response;
+        },
+      });
+    }
+  }
+
   if (self.constructor.name === 'Window' && top === window) {
     // main document
     const version = 'version_' + new URL(document.querySelector('script').src).searchParams.get('version');
@@ -2055,6 +2173,51 @@
             CurrentSession.ClientIntegrity.htmlHash,
           ));
 
+          // Initial Keys
+          CurrentSession.initialRandom = crypto.getRandomValues(new Uint8Array(clientRandomBytes));
+          const cache = await caches.open(version);
+          if (cache) {
+            const responses = await cache.matchAll(INTEGRITY_PSEUDO_URL);
+            if (responses && responses.length > 0) {
+              const response = responses[0];
+              const random = response.headers.get('x-cache-random');
+              if (random) {
+                // pick up random from cache
+                const randomBinaryString = atob(random);
+                const randomUint8Array = Uint8Array.from(randomBinaryString, c => c.charCodeAt(0));
+                CurrentSession.initialRandom = randomUint8Array;
+              }
+            }
+          }
+          CurrentSession.initialSecret = await HKDF.Extract(0, HKDF.concat(
+            CurrentSession.initialRandom,
+            CurrentSession.ClientIntegrity.userAgentHash,
+            CurrentSession.ClientIntegrity.browserHash,
+            CurrentSession.ClientIntegrity.scriptsHash,
+            CurrentSession.ClientIntegrity.htmlHash,
+          ));
+          CurrentSession.initialSalt =
+            await HKDF.Expand_Label(CurrentSession.initialSecret, 'salt', '', HMAC.saltLength);
+          CurrentSession.initialSaltKey =
+            await crypto.subtle.importKey(
+              'raw',
+              CurrentSession.initialSalt,
+              {
+                name: 'HMAC',
+                hash: {
+                  name: SHA256.hashName,
+                },
+              },
+              false,
+              ['sign', 'verify']
+            );
+          // Discard initialSecret
+          crypto.getRandomValues(new Uint8Array(CurrentSession.initialSecret));
+          delete CurrentSession.initialSecret;
+          // Discard initialSalt
+          crypto.getRandomValues(new Uint8Array(CurrentSession.initialSalt));
+          delete CurrentSession.initialSalt;
+
           // Discard ClientIntegrity
           [ 'userAgentHash', 'browserHash', 'scriptsHash', 'htmlHash' ].forEach((name) => {
             crypto.getRandomValues(new Uint8Array(CurrentSession.ClientIntegrity[name]));
@@ -2902,7 +3065,7 @@
       }
 
       const entryPageRefresherHtml = function entryPageRefresherHtml(request) {
-        return `<html><head><meta http-equiv="refresh" content = "0;URL=${request.url}" ></head><body></body></html>`;
+        throw new Error('decodeEntryHtml: refreshing entry page ' + request.url);
       }
       hook.parameters.decodeEntryHtml = async function (event, request, response, cache, original, decoded) {
         await getIntegrityJSON(cache);

diff --git a/demo-frontend/components/thin-hook/demo/integrity.js.gz b/demo-frontend/components/thin-hook/demo/integrity.js.gz
diff --git a/demo-frontend/components/thin-hook/demo/integrity.json b/demo-frontend/components/thin-hook/demo/integrity.json
@@ -3494,13 +3494,13 @@
   "/components/thin-hook/demo/bundle.json": "NKwjN4DXt2s+80XoHlFlWbnI5rklchdQCerPDjtfBIk=",
   "/components/thin-hook/demo/cache-automation.js": "x2G0JD1JJOVC3rhFCrQnigaYlTu7C5vhOTRHBixXcS4=",
   "/components/thin-hook/demo/cache-bundle.js": "xZ1Ebqkx3yhzbVhtwmh3Mdrbczw8/WRMffOvs2pq45o=",
-  "/components/thin-hook/demo/cache-bundle.json": "CcWXHS4EVjyy41za+kC7mdP2WUyfG+kLkCR2MIslvAs=",
+  "/components/thin-hook/demo/cache-bundle.json": "3W/x+UUlKJHXvSypXISxI+d0M64ylTqNnlr7xy6hFow=",
   "/components/thin-hook/demo/commonjs.js": "KjmEtrrjEj4WCR1bjCEOZnXhe+9w4wJoaUg40WU0FuQ=",
   "/components/thin-hook/demo/commonjs2.js": "tiHpF2aP1nZUY/O31R9j/kWne3jFgqPIds0MwNLxhk4=",
   "/components/thin-hook/demo/content-loader.js": "AkIBbiiHsyKrKLiH8Dd5xjiZ2yMrsDbXlKAnjbnlQzk=",
   "/components/thin-hook/demo/context-generator.js": "Q3SuHyjOwrlpq0iIlaQmYkTWXijh+Cco/SzTkTD+DZ4=",
   "/components/thin-hook/demo/disable-devtools.js": "qBIJIoIJlBCXrEHFvaO8HNZDdeabfIETr/aML+Zyn/I=",
-  "/components/thin-hook/demo/empty-document.html": "5ol5QmbeRCKvL9PnvlwBnyMwhtZHFuDvZQ3bzqc6Xm0=",
+  "/components/thin-hook/demo/empty-document.html": "ZMEHMCT1sAV0N7KkZVgbPIgBpyttPtYV9OgtbWe3m5I=",
   "/components/thin-hook/demo/es6-module.js": "fqNv9zHgC8txL7mU0+zySAwIQNRjpTVJtDI34AWzvOY=",
   "/components/thin-hook/demo/es6-module2.js": "m8es06TrC+X9xZ9p6bWrs0s4su7FcMoZak389t8NOyY=",
   "/components/thin-hook/demo/es6-module3.js": "qq7q9Gk9vgQSZmElUAaLOEQxALCbP9ysHKqQjwyas+Y=",
@@ -3515,7 +3515,7 @@
   "/components/thin-hook/demo/hook-worker.js": "W2FaqIWgUYRmFTvm7LLP7vEwDxgf9gypHK2WRlnJIFI=",
   "/components/thin-hook/demo/index-fb.html": "D9idm83/VxddYcF1L/fb3Vu6W5n8IDX4lH5KG66DSFk=",
   "/components/thin-hook/demo/inline-script.svg": "NRdobFKL9ufnJCuVHoPLUUsXRBgGgjY3EdwWwHjm/GQ=",
-  "/components/thin-hook/demo/integrity.js": "4BWd+l0MfGDu6boBh7igO0aMBE92hOVpF+KQTfhkhH4=",
+  "/components/thin-hook/demo/integrity.js": "GL7l3X+inLlYpXU34DiWR9Jz7cKUXdCjxisbIv5s5KE=",
   "/components/thin-hook/demo/invalid-document.html": "KAPziibQgBjvjZ6VlnXTeFUTkAuZVpd3BtX0pBKBzzI=",
   "/components/thin-hook/demo/lhs.js": "h12n3evI8zqX4nFe66ZlwpbdwgB/o8YZJjkxFVPVOIQ=",
   "/components/thin-hook/demo/locales/bundle.de.json": "yBx145NiuX8NYTjr4YnQDauqpPg2forcuXjFqtzYq70=",
@@ -3551,14 +3551,14 @@
   "/components/thin-hook/demo/my-view2.json": "PptwWPvugpMTpsXZFfaSVwr2BcYSGJkfhjEiV6RrFJI=",
   "/components/thin-hook/demo/my-view3.html": "pSmI7cALKmeqoKKZefU8NicI4V0ZUcScMGSklkVBeFw=",
   "/components/thin-hook/demo/my-view3.json": "uatxD9AZkiGiFvGsMqhTVLNxAqDiylbvuGors1Hb1hc=",
-  "/components/thin-hook/demo/no-hook-authorization.js": "ksLEQ0Iene6cDD9j6t0y5IUomRn+I4sMYyQT3gUHfMg=",
+  "/components/thin-hook/demo/no-hook-authorization.js": "9XKiCE4faqpr63GXjo7j1CJqK4DPMua7ZQziNSFuQyk=",
   "/components/thin-hook/demo/normalize.js": "NR4ascAVcGMTlFBzO9xCSwK5RGd53cGFIj4DD91negQ=",
   "/components/thin-hook/demo/script-hashes.js": "ugdlTRwkonG6D6fuXFXNYMAhM7DlPLa7bmNNpHOx5UA=",
   "/components/thin-hook/demo/shared-worker-client.js": "S2kPqWZdJJufPAFJdkZVDdmBtjQLAVfvrDv1sAIAe68=",
   "/components/thin-hook/demo/shared-worker.js": "B9AZYCwUFTYmnEXQ0hLA6JJbVR5vakBrX3426XaEbbI=",
   "/components/thin-hook/demo/spread.js": "gpfCZwAb/tn4HErIHzwhcCC0eMbvuzExYzK97dlma2A=",
-  "/components/thin-hook/demo/sub-document.html": "CXf9Ynx1rkRebH/R94tq0gahnNIK4el0xi1qdj42lFw=",
-  "/components/thin-hook/demo/sub-sub-document.html": "S2gQO2lyCaTV4tHBFqVwHUC619wam+j+MhCxofUFvG4=",
+  "/components/thin-hook/demo/sub-document.html": "qS7c24BGVp+v3uuSehxpn581fusFrAzLnr3BueXgjcM=",
+  "/components/thin-hook/demo/sub-sub-document.html": "ma/NkS5wpHkiqGVUO0aiEMmKsJt4JmwWh4Cp4cEExYw=",
   "/components/thin-hook/demo/unauthorized-no-hook-script.js": "YjNcphHrG7UkmBspO6aCgkw+hh4Y7XvsD4TmuplpABE=",
   "/components/thin-hook/demo/unauthorized-no-hook-worker-script.js": "j5e2u8zJ41kNLbACDJCY/DJkneDOzuWJwZ+lw2bh1XE=",
   "/components/thin-hook/demo/web-worker-client.js": "FhT92G7+i2J0phFIjMhq2k3/R6KVNUaSg3QOcy7RKbI=",
@@ -3573,7 +3573,7 @@
   "/components/thin-hook/demo/xliff/bundle.fr.xlf": "qC940/MZ/rG31gok/D9KPHYD/xRCkziCBIUwhgxdovI=",
   "/components/thin-hook/demo/xliff/bundle.ja.xlf": "QbZEDWcoqnJyqKIHA8rGr7rNYmG67RAHOyw1/oEXWu8=",
   "/components/thin-hook/demo/xliff/bundle.zh-Hans.xlf": "AyxbV4426iZK9PQB6O+s3JIoA3sO+4lVOQlSrwP7+/U=",
-  "/components/thin-hook/hook.min.js": "KvMTtwLiRbnOTiN1dk/CeIAGyhlmJPiRcfFdcIjolDo=",
+  "/components/thin-hook/hook.min.js": "XwXi6pXmieY8gi1LSrcZ4kGBc+hiO8L+KpxqIl0XnVU=",
   "/components/vaadin-grid/all-imports.html": "LMCPxNwxFswTTdXlEHbdRxOpL5SpqCPSHCLSit7xLw0=",
   "/components/vaadin-grid/bower.json": "0nox4NkE51Wy3KhWPvlJ7leWO6MhyCx6utOGLMOCBxA=",
   "/components/vaadin-grid/grid.gif": "bYmTEFtW4rCFnHX6m7k0XnOBHnVBsgAs4WEPiEoy4dc=",

diff --git a/demo-frontend/components/thin-hook/demo/integrity.json.gz b/demo-frontend/components/thin-hook/demo/integrity.json.gz
diff --git a/demo-frontend/components/thin-hook/demo/no-hook-authorization.js b/demo-frontend/components/thin-hook/demo/no-hook-authorization.js
@@ -13,7 +13,7 @@ else {
     //   hook.parameters.noHookAuthorizationFailed
     // JSONs are output to console in the learning mode
     //'*': true, 
-    "2af313b702e245b9ce4e2375764fc2788006ca196624f89171f15d7088e8943a": true, // hook.min.js
+    "5f05e2ea95e689e63c822d4b4ab719e2418173e8623bc2fe2a9c6a225d179d55": true, // hook.min.js
     "a81209228209941097ac41c5bda3bc1cd64375e69b7c8113aff68c2fe6729ff2": true, // demo/disable-devtools.js
     "4374ae1f28cec2b969ab488895a4266244d65e28e1f82728fd2cd39130fe0d9e": true, // demo/context-generator.js
     "1ee7f14796c38cca2d5ab12ec10d4ce389c8bfa3b11e57905e55f1e3fdced914": true, // demo/bootstrap.js
@@ -33,7 +33,7 @@ else {
     "c135fd6ba3cad41e63985ecca191995bf311abc756c5f574ef5b641e7db56914": true, // (function writeln2() { console.log("no-hook script tag via document.writeln"); })()
     "e233738578fd7e8f2e961fb11885e2c187146314a8e3fc65692633ff89c5d34a": true, // (function writeln4() { console.log("no-hook script tag in div tag via document.writeln"); })()
     "4f0395d52a8c1c7edaacacade9c31fe18555b79ce963dfb1abaaa34990993374": true, // location = "about:blank";
-    "e0159dfa5d0c7c60eee9ba0187b8a03b468c044f7684e56917e2904df864847e": true, // demo/integrity.js
+    "18bee5dd7fa29cb958a57537e0389647d273edc2945dd0a3c62b1b22fe6ce4a1": true, // demo/integrity.js
     "ba07654d1c24a271ba0fa7ee5c55cd60c02133b0e53cb6bb6e634da473b1e540": true, // demo/script-hashes.js
     "0242016e2887b322ab28b887f03779c63899db232bb036d794a0278db9e54339": true, // demo/content-loader.js
   };

diff --git a/demo-frontend/components/thin-hook/demo/no-hook-authorization.js.gz b/demo-frontend/components/thin-hook/demo/no-hook-authorization.js.gz
diff --git a/demo-frontend/components/thin-hook/hook.min.js b/demo-frontend/components/thin-hook/hook.min.js
diff --git a/demo-frontend/components/thin-hook/hook.min.js.gz b/demo-frontend/components/thin-hook/hook.min.js.gz