Skip to content

Commit 1c6d567

Browse files
panvapanva
committed
fixup! test: add WebCrypto Promise.prototype.then pollution regression tests
1 parent f9f70b3 commit 1c6d567

1 file changed

Lines changed: 48 additions & 84 deletions

File tree

‎test/parallel/test-webcrypto-promise-prototype-pollution.mjs‎

Lines changed: 48 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -7,125 +7,89 @@ if (!common.hasCrypto) common.skip('missing crypto');
77
// Regression test for https://github.com/nodejs/node/pull/61492
88
// and https://github.com/nodejs/node/issues/59699.
99

10-
import * as assert from 'node:assert/strict';
1110
import { hasOpenSSL } from '../common/crypto.js';
1211

1312
const { subtle } = globalThis.crypto;
1413

15-
const originalThen = Promise.prototype.then;
16-
const intercepted = [];
17-
18-
// Pollute Promise.prototype.then to record all resolved values.
19-
Promise.prototype.then = function(onFulfilled, ...rest) {
20-
return originalThen.call(this, function(value) {
21-
intercepted.push(value);
22-
return typeof onFulfilled === 'function' ? onFulfilled(value) : value;
23-
}, ...rest);
24-
};
25-
26-
async function test(label, fn) {
27-
const result = await fn();
28-
assert.strictEqual(
29-
intercepted.length, 0,
30-
`Promise.prototype.then was called during ${label}`
31-
);
32-
return result;
33-
}
14+
Promise.prototype.then = common.mustNotCall('Promise.prototype.then');
3415

35-
await test('digest', () =>
36-
subtle.digest('SHA-256', new Uint8Array([1, 2, 3])));
16+
await subtle.digest('SHA-256', new Uint8Array([1, 2, 3]));
3717

38-
await test('generateKey (AES-CBC)', () =>
39-
subtle.generateKey({ name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']));
18+
await subtle.generateKey({ name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']);
4019

41-
await test('generateKey (ECDSA)', () =>
42-
subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']));
20+
await subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
4321

4422
const rawKey = globalThis.crypto.getRandomValues(new Uint8Array(32));
4523

46-
const importedKey = await test('importKey', () =>
47-
subtle.importKey('raw', rawKey, { name: 'AES-CBC', length: 256 }, false, ['encrypt', 'decrypt']));
24+
const importedKey = await subtle.importKey(
25+
'raw', rawKey, { name: 'AES-CBC', length: 256 }, false, ['encrypt', 'decrypt']);
4826

49-
const exportableKey = await test('importKey (extractable)', () =>
50-
subtle.importKey('raw', rawKey, { name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']));
27+
const exportableKey = await subtle.importKey(
28+
'raw', rawKey, { name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']);
5129

52-
await test('exportKey', () =>
53-
subtle.exportKey('raw', exportableKey));
30+
await subtle.exportKey('raw', exportableKey);
5431

5532
const iv = globalThis.crypto.getRandomValues(new Uint8Array(16));
5633
const plaintext = new TextEncoder().encode('Hello, world!');
5734

58-
const ciphertext = await test('encrypt', () =>
59-
subtle.encrypt({ name: 'AES-CBC', iv }, importedKey, plaintext));
35+
const ciphertext = await subtle.encrypt({ name: 'AES-CBC', iv }, importedKey, plaintext);
6036

61-
await test('decrypt', () =>
62-
subtle.decrypt({ name: 'AES-CBC', iv }, importedKey, ciphertext));
37+
await subtle.decrypt({ name: 'AES-CBC', iv }, importedKey, ciphertext);
6338

64-
const signingKey = await test('generateKey (HMAC)', () =>
65-
subtle.generateKey({ name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']));
39+
const signingKey = await subtle.generateKey(
40+
{ name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']);
6641

6742
const data = new TextEncoder().encode('test data');
6843

69-
const signature = await test('sign', () =>
70-
subtle.sign('HMAC', signingKey, data));
44+
const signature = await subtle.sign('HMAC', signingKey, data);
7145

72-
await test('verify', () =>
73-
subtle.verify('HMAC', signingKey, signature, data));
46+
await subtle.verify('HMAC', signingKey, signature, data);
7447

75-
const pbkdf2Key = await test('importKey (PBKDF2)', () =>
76-
subtle.importKey('raw', rawKey, 'PBKDF2', false, ['deriveBits', 'deriveKey']));
48+
const pbkdf2Key = await subtle.importKey(
49+
'raw', rawKey, 'PBKDF2', false, ['deriveBits', 'deriveKey']);
7750

78-
await test('deriveBits', () =>
79-
subtle.deriveBits(
80-
{ name: 'PBKDF2', salt: rawKey, iterations: 1000, hash: 'SHA-256' },
81-
pbkdf2Key, 256));
51+
await subtle.deriveBits(
52+
{ name: 'PBKDF2', salt: rawKey, iterations: 1000, hash: 'SHA-256' },
53+
pbkdf2Key, 256);
8254

83-
// deriveKey — this was the primary leak reported in the issue
84-
await test('deriveKey', () =>
85-
subtle.deriveKey(
86-
{ name: 'PBKDF2', salt: rawKey, iterations: 1000, hash: 'SHA-256' },
87-
pbkdf2Key,
88-
{ name: 'AES-CBC', length: 256 },
89-
true,
90-
['encrypt', 'decrypt']));
55+
await subtle.deriveKey(
56+
{ name: 'PBKDF2', salt: rawKey, iterations: 1000, hash: 'SHA-256' },
57+
pbkdf2Key,
58+
{ name: 'AES-CBC', length: 256 },
59+
true,
60+
['encrypt', 'decrypt']);
9161

92-
const wrappingKey = await test('generateKey (AES-KW)', () =>
93-
subtle.generateKey({ name: 'AES-KW', length: 256 }, true, ['wrapKey', 'unwrapKey']));
62+
const wrappingKey = await subtle.generateKey(
63+
{ name: 'AES-KW', length: 256 }, true, ['wrapKey', 'unwrapKey']);
9464

95-
const keyToWrap = await test('generateKey (AES-CBC for wrap)', () =>
96-
subtle.generateKey({ name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']));
65+
const keyToWrap = await subtle.generateKey(
66+
{ name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']);
9767

98-
const wrapped = await test('wrapKey', () =>
99-
subtle.wrapKey('raw', keyToWrap, wrappingKey, 'AES-KW'));
68+
const wrapped = await subtle.wrapKey('raw', keyToWrap, wrappingKey, 'AES-KW');
10069

101-
await test('unwrapKey', () =>
102-
subtle.unwrapKey(
103-
'raw', wrapped, wrappingKey, 'AES-KW',
104-
{ name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']));
70+
await subtle.unwrapKey(
71+
'raw', wrapped, wrappingKey, 'AES-KW',
72+
{ name: 'AES-CBC', length: 256 }, true, ['encrypt', 'decrypt']);
10573

106-
const { privateKey } = await test('generateKey (ECDSA for getPublicKey)', () =>
107-
subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']));
74+
const { privateKey } = await subtle.generateKey(
75+
{ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
10876

109-
await test('getPublicKey', () =>
110-
subtle.getPublicKey(privateKey, ['verify']));
77+
await subtle.getPublicKey(privateKey, ['verify']);
11178

11279
if (hasOpenSSL(3, 5)) {
113-
const kemPair = await test('generateKey (ML-KEM-768)', () =>
114-
subtle.generateKey(
115-
{ name: 'ML-KEM-768' }, false,
116-
['encapsulateKey', 'encapsulateBits', 'decapsulateKey', 'decapsulateBits']));
80+
const kemPair = await subtle.generateKey(
81+
{ name: 'ML-KEM-768' }, false,
82+
['encapsulateKey', 'encapsulateBits', 'decapsulateKey', 'decapsulateBits']);
11783

118-
const { ciphertext: ct1 } = await test('encapsulateKey', () =>
119-
subtle.encapsulateKey(
120-
{ name: 'ML-KEM-768' }, kemPair.publicKey, 'HKDF', false, ['deriveBits']));
84+
const { ciphertext: ct1 } = await subtle.encapsulateKey(
85+
{ name: 'ML-KEM-768' }, kemPair.publicKey, 'HKDF', false, ['deriveBits']);
12186

122-
await test('decapsulateKey', () =>
123-
subtle.decapsulateKey(
124-
{ name: 'ML-KEM-768' }, kemPair.privateKey, ct1, 'HKDF', false, ['deriveBits']));
87+
await subtle.decapsulateKey(
88+
{ name: 'ML-KEM-768' }, kemPair.privateKey, ct1, 'HKDF', false, ['deriveBits']);
12589

126-
const { ciphertext: ct2 } = await test('encapsulateBits', () =>
127-
subtle.encapsulateBits({ name: 'ML-KEM-768' }, kemPair.publicKey));
90+
const { ciphertext: ct2 } = await subtle.encapsulateBits(
91+
{ name: 'ML-KEM-768' }, kemPair.publicKey);
12892

129-
await test('decapsulateBits', () =>
130-
subtle.decapsulateBits({ name: 'ML-KEM-768' }, kemPair.privateKey, ct2));
93+
await subtle.decapsulateBits(
94+
{ name: 'ML-KEM-768' }, kemPair.privateKey, ct2);
13195
}

0 commit comments

Comments
 (0)