Files
node/test/parallel/test-webcrypto-hash-normalization.js
Filip Skokan 33a4935b84 crypto: validate normalized hash names
Check the normalized SHA algorithm instead of reading the caller hash
name before conversion. This prevents changing getters from bypassing
the supported hash check.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66237
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
2026-09-25 13:23:07 +00:00

48 lines
1.6 KiB
JavaScript

'use strict';
const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
const { subtle } = globalThis.crypto;
(async () => {
const data = new Uint8Array(32);
let reads = 0;
const key = await subtle.importKey('raw', data, {
name: 'HMAC',
hash: {
get name() {
reads++;
return reads === 1 ? 'SHA-384' : 'SHA-256';
},
},
}, false, ['sign']);
assert.strictEqual(reads, 1);
assert.strictEqual(key.algorithm.hash.name, 'SHA-384');
assert.strictEqual((await subtle.sign('HMAC', key, data)).byteLength, 48);
const converted = await subtle.importKey('raw', data, {
name: 'HMAC',
hash: { name: { toString() { return 'SHA-256'; } } },
}, false, ['sign']);
assert.strictEqual(converted.algorithm.hash.name, 'SHA-256');
await assert.rejects(subtle.importKey('raw', data, {
name: 'HMAC', hash: {},
}, false, ['sign']), TypeError);
const cshakeAvailable = SubtleCrypto.supports('digest', {
name: 'cSHAKE128', outputLength: 256,
});
await assert.rejects(subtle.importKey('raw', data, {
name: 'HMAC', hash: 'cSHAKE128',
}, false, ['sign']), cshakeAvailable ? TypeError : { name: 'NotSupportedError' });
await assert.rejects(subtle.importKey('raw', data, {
name: 'HMAC', hash: 'MD5', length: -1,
}, false, ['sign']), TypeError);
await assert.rejects(subtle.importKey('raw', data, {
name: 'HMAC', hash: { name: 'cSHAKE128', outputLength: 256 },
}, false, ['sign']), { name: 'NotSupportedError' });
})().then(common.mustCall());