Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

crypto: fix aes crash when tag length too small #38914

Closed
wants to merge 4 commits into from

Conversation

XadillaX
Copy link
Contributor

@XadillaX XadillaX commented Jun 3, 2021

Refs: #38883

@XadillaX XadillaX changed the title Crypto tag bytelength crypto: fix aes crash when tag length too small Jun 3, 2021
@github-actions github-actions bot added crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels Jun 3, 2021
false,
[ 'encrypt', 'decrypt' ])
.then((k) => {
assert.rejects(async () => {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This function does not need the async keyword, and using it hides whether the exception is thrown synchronously or the Promise is actually rejected.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmmmmm, Chrome rejects this situation in Promise. So shall we do reject or throw?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

window.crypto.subtle.decrypt({name: 'AES-GCM', iv: new Uint8Array(12)}, k, new Uint8Array(0));
> Promise {<pending>}
Uncaught (in promise) DOMException: The provided data is too small

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe that the behavior is correct, and the test works, but it isn't as strict as it could be. assert.rejects is fine, but the async weakens the test:

function fnThatThrows() { throw new Error(); }
async function fnThatRejects() { throw new Error(); }

// With 'async':

assert.rejects(async () => fnThatRejects()); // passes
assert.rejects(async () => fnThatThrows()); // passes, but should not!

// Now remove the 'async' keyword:

assert.rejects(() => fnThatRejects()); // passes
assert.rejects(() => fnThatThrows()); // fails as it should

So I'd simply remove the async keyword from the function declaration :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've resolved it.

@nodejs-github-bot
Copy link
Collaborator

@nodejs-github-bot
Copy link
Collaborator

@nodejs-github-bot
Copy link
Collaborator

XadillaX added a commit that referenced this pull request Jun 15, 2021
Fixes: #38883

PR-URL: #38914
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
@XadillaX
Copy link
Contributor Author

Landed in 7a9635b

@XadillaX XadillaX closed this Jun 15, 2021
danielleadams pushed a commit that referenced this pull request Jun 21, 2021
Fixes: #38883

PR-URL: #38914
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>
@danielleadams danielleadams mentioned this pull request Jun 21, 2021
@richardlau
Copy link
Member

This doesn't land cleanly on v14.x-staging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Decrypting a zero-length array with SubtleCrypto triggers Assertion failures
5 participants