Files
node/test/parallel/test-webcrypto-parameter-species.js
Filip Skokan 71689e8d39 crypto: copy parameters without array species
Allocate byte copies directly so typed-array species cannot replace
normalized parameters or bit-truncated key material.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66237
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>
2026-09-25 13:23:12 +00:00

37 lines
1.3 KiB
JavaScript

'use strict';
const common = require('../common');
if (!common.hasCrypto)
common.skip('missing crypto');
const assert = require('assert');
const { subtle } = globalThis.crypto;
function withSpecies(callback) {
Object.defineProperty(Uint8Array, Symbol.species, {
configurable: true,
value: Float64Array,
});
try {
return callback();
} finally {
delete Uint8Array[Symbol.species];
}
}
(async () => {
const key = await subtle.importKey('raw', new Uint8Array(16),
'AES-GCM', false, ['encrypt']);
const algorithm = { name: 'AES-GCM', iv: new Uint8Array(12).fill(1) };
const data = new Uint8Array(16);
const expected = await subtle.encrypt(algorithm, key, data);
assert.deepStrictEqual(await withSpecies(() => subtle.encrypt(algorithm, key, data)), expected);
const hmac = { name: 'HMAC', hash: 'SHA-256', length: 100 };
const secret = new Uint8Array(13).fill(1);
const normal = await subtle.importKey('raw', secret, hmac, true, ['sign']);
const tampered = await withSpecies(() => subtle.importKey('raw', secret, hmac, true, ['sign']));
assert.deepStrictEqual(await subtle.exportKey('raw', tampered), await subtle.exportKey('raw', normal));
assert.deepStrictEqual(await subtle.sign('HMAC', tampered, data), await subtle.sign('HMAC', normal, data));
})().then(common.mustCall());