Commit 2a7a69c
crypto: reject unintended raw key format string input
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #62974
Reviewed-By: Сковорода Никита Андреевич <chalkerx@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>1 parent 2b88566 commit 2a7a69c
2 files changed
Lines changed: 45 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -659,7 +659,7 @@ function prepareAsymmetricKey(key, ctx, name = 'key') { | |||
| 659 | 659 | return { data, format: kKeyFormatJWK }; | |
| 660 | 660 | } else if (format === 'raw-public' || format === 'raw-private' || | |
| 661 | 661 | format === 'raw-seed') { | |
| 662 | - if (!isStringOrBuffer(data)) { | ||
| 662 | + if (!isArrayBufferView(data) && !isAnyArrayBuffer(data)) { | ||
| 663 | 663 | throw new ERR_INVALID_ARG_TYPE( | |
| 664 | 664 | `${name}.key`, | |
| 665 | 665 | ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView'], | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -32,6 +32,50 @@ const { hasOpenSSL } = require('../common/crypto'); | |||
| 32 | 32 | } | |
| 33 | 33 | } | |
| 34 | 34 | ||
| 35 | + // Raw key imports do not support strings. | ||
| 36 | + { | ||
| 37 | + const pubKeyObj = crypto.createPublicKey( | ||
| 38 | + fixtures.readKey('ed25519_public.pem', 'ascii')); | ||
| 39 | + const privKeyObj = crypto.createPrivateKey( | ||
| 40 | + fixtures.readKey('ed25519_private.pem', 'ascii')); | ||
| 41 | + | ||
| 42 | + const rawPub = pubKeyObj.export({ format: 'raw-public' }); | ||
| 43 | + const rawPriv = privKeyObj.export({ format: 'raw-private' }); | ||
| 44 | + | ||
| 45 | + for (const encoding of ['hex', 'base64', 'utf8', 'latin1', 'ascii']) { | ||
| 46 | + assert.throws(() => crypto.createPublicKey({ | ||
| 47 | + key: rawPub.toString(encoding), | ||
| 48 | + encoding, | ||
| 49 | + format: 'raw-public', | ||
| 50 | + asymmetricKeyType: 'ed25519', | ||
| 51 | + }), { code: 'ERR_INVALID_ARG_TYPE' }); | ||
| 52 | + | ||
| 53 | + assert.throws(() => crypto.createPrivateKey({ | ||
| 54 | + key: rawPriv.toString(encoding), | ||
| 55 | + encoding, | ||
| 56 | + format: 'raw-private', | ||
| 57 | + asymmetricKeyType: 'ed25519', | ||
| 58 | + }), { code: 'ERR_INVALID_ARG_TYPE' }); | ||
| 59 | + } | ||
| 60 | + } | ||
| 61 | + | ||
| 62 | + // Raw seed imports do not support strings. | ||
| 63 | + if (hasOpenSSL(3, 5)) { | ||
| 64 | + const privKeyObj = crypto.createPrivateKey( | ||
| 65 | + fixtures.readKey('ml_dsa_44_private.pem', 'ascii')); | ||
| 66 | + | ||
| 67 | + const rawSeed = privKeyObj.export({ format: 'raw-seed' }); | ||
| 68 | + | ||
| 69 | + for (const encoding of ['hex', 'base64']) { | ||
| 70 | + assert.throws(() => crypto.createPrivateKey({ | ||
| 71 | + key: rawSeed.toString(encoding), | ||
| 72 | + encoding, | ||
| 73 | + format: 'raw-seed', | ||
| 74 | + asymmetricKeyType: 'ml-dsa-44', | ||
| 75 | + }), { code: 'ERR_INVALID_ARG_TYPE' }); | ||
| 76 | + } | ||
| 77 | + } | ||
| 78 | + | ||
| 35 | 79 | // Key types that don't support raw-* formats | |
| 36 | 80 | { | |
| 37 | 81 | for (const [type, pub, priv] of [ | |
0 commit comments