Summary

There are two minor problems as explained in the next section.

How to reproduce

In the hint-1.txtthere are two examples given as follows:

Example 1:
$ var s = { toString: function() { alert('Exploit 1'); } };
$ CryptoAPI.sha1.hash(s)

Example 2:
$ var s = { toString: function() { alert('Exploit 1'); } };
$ CryptoAPI.sha1.hash("abc")

Nonetheless, the second example doesn't demonstrate anything and should be removed.

In solution.js the line 62 should be changed from:

if ((i & 63) == 63) CryptoAPI.sha1._round(H, w);

to:

if ((i & 63) == 63) internalRound(H, w);

This is explained in the text of the solution, but the code base is not synced with that description.