Commit 188c3ab
crypto: adjust types for getRandomValues
prevents Web Crypto API's getRandomValues from accepting DataView
Fixes: #41480
Refs: https://www.w3.org/TR/WebCryptoAPI/#Crypto-method-getRandomValues
PR-URL: #41481
Reviewed-By: Derek Lewis <DerekNonGeneric@inf.is>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Zeyu Yang <himself65@outlook.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent 5f0a017 commit 188c3ab
3 files changed
Lines changed: 10 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -357,12 +357,15 @@ Provides access to the `SubtleCrypto` API. | |||
| 357 | 357 | added: v15.0.0 | |
| 358 | 358 | --> | |
| 359 | 359 | ||
| 360 | - * `typedArray` {Buffer|TypedArray|DataView|ArrayBuffer} | ||
| 361 | - * Returns: {Buffer|TypedArray|DataView|ArrayBuffer} Returns `typedArray`. | ||
| 360 | + * `typedArray` {Buffer|TypedArray} | ||
| 361 | + * Returns: {Buffer|TypedArray} | ||
| 362 | 362 | ||
| 363 | 363 | Generates cryptographically strong random values. The given `typedArray` is | |
| 364 | 364 | filled with random values, and a reference to `typedArray` is returned. | |
| 365 | 365 | ||
| 366 | + The given `typedArray` must be an integer-based instance of {TypedArray}, | ||
| 367 | + i.e. `Float32Array` and `Float64Array` are not accepted. | ||
| 368 | + | ||
| 366 | 369 | An error will be thrown if the given `typedArray` is larger than 65,536 bytes. | |
| 367 | 370 | ||
| 368 | 371 | ### `crypto.randomUUID()` | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -50,6 +50,7 @@ const { | |||
| 50 | 50 | const { | |
| 51 | 51 | isArrayBufferView, | |
| 52 | 52 | isAnyArrayBuffer, | |
| 53 | + isTypedArray, | ||
| 53 | 54 | isFloat32Array, | |
| 54 | 55 | isFloat64Array, | |
| 55 | 56 | } = require('internal/util/types'); | |
@@ -307,7 +308,7 @@ function onJobDone(buf, callback, error) { | |||
| 307 | 308 | // not allowed to exceed 65536 bytes, and can only | |
| 308 | 309 | // be an integer-type TypedArray. | |
| 309 | 310 | function getRandomValues(data) { | |
| 310 | - if (!isArrayBufferView(data) || | ||
| 311 | + if (!isTypedArray(data) || | ||
| 311 | 312 | isFloat32Array(data) || | |
| 312 | 313 | isFloat64Array(data)) { | |
| 313 | 314 | // Ordinarily this would be an ERR_INVALID_ARG_TYPE. However, | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -13,6 +13,7 @@ const { getRandomValues } = require('crypto').webcrypto; | |||
| 13 | 13 | undefined, null, '', 1, {}, [], | |
| 14 | 14 | new Float32Array(1), | |
| 15 | 15 | new Float64Array(1), | |
| 16 | + new DataView(new ArrayBuffer(1)), | ||
| 16 | 17 | ].forEach((i) => { | |
| 17 | 18 | assert.throws( | |
| 18 | 19 | () => getRandomValues(i), | |
@@ -32,6 +33,7 @@ const intTypedConstructors = [ | |||
| 32 | 33 | Uint8Array, | |
| 33 | 34 | Uint16Array, | |
| 34 | 35 | Uint32Array, | |
| 36 | + Uint8ClampedArray, | ||
| 35 | 37 | BigInt64Array, | |
| 36 | 38 | BigUint64Array, | |
| 37 | 39 | ]; | |
@@ -47,7 +49,7 @@ for (const ctor of intTypedConstructors) { | |||
| 47 | 49 | { | |
| 48 | 50 | const buf = new Uint16Array(10); | |
| 49 | 51 | const before = Buffer.from(buf).toString('hex'); | |
| 50 | - getRandomValues(new DataView(buf.buffer)); | ||
| 52 | + getRandomValues(buf); | ||
| 51 | 53 | const after = Buffer.from(buf).toString('hex'); | |
| 52 | 54 | assert.notStrictEqual(before, after); | |
| 53 | 55 | } | |
0 commit comments