Skip to content

Commit 0a075cb

Browse files
panvadanielleadams
authored andcommitted
crypto: fix webcrypto JWK EC and OKP import crv check
PR-URL: #43346 Reviewed-By: Tobias Nießen <[email protected]>
1 parent 56b8cc5 commit 0a075cb

File tree

4 files changed

+49
-5
lines changed

4 files changed

+49
-5
lines changed

lib/internal/crypto/cfrg.js

+2
Original file line numberDiff line numberDiff line change
@@ -242,6 +242,8 @@ async function cfrgImportKey(
242242
throw lazyDOMException('Invalid JWK keyData', 'DataError');
243243
if (keyData.kty !== 'OKP')
244244
throw lazyDOMException('Invalid key type', 'DataError');
245+
if (keyData.crv !== name)
246+
throw lazyDOMException('Subtype mismatch', 'DataError');
245247
const isPublic = keyData.d === undefined;
246248

247249
if (usagesSet.size > 0 && keyData.use !== undefined) {

lib/internal/crypto/ec.js

+7-5
Original file line numberDiff line numberDiff line change
@@ -195,11 +195,12 @@ async function ecImportKey(
195195
break;
196196
}
197197
case 'jwk': {
198-
let curve;
199198
if (keyData == null || typeof keyData !== 'object')
200199
throw lazyDOMException('Invalid JWK keyData', 'DataError');
201200
if (keyData.kty !== 'EC')
202201
throw lazyDOMException('Invalid key type', 'DataError');
202+
if (keyData.crv !== namedCurve)
203+
throw lazyDOMException('Named curve mismatch', 'DataError');
203204

204205
if (keyData.d !== undefined) {
205206
verifyAcceptableEcKeyUse(name, 'private', usagesSet);
@@ -225,12 +226,13 @@ async function ecImportKey(
225226
if (algorithm.name === 'ECDSA' && keyData.alg !== undefined) {
226227
if (typeof keyData.alg !== 'string')
227228
throw lazyDOMException('Invalid alg', 'DataError');
229+
let algNamedCurve;
228230
switch (keyData.alg) {
229-
case 'ES256': curve = 'P-256'; break;
230-
case 'ES384': curve = 'P-384'; break;
231-
case 'ES512': curve = 'P-521'; break;
231+
case 'ES256': algNamedCurve = 'P-256'; break;
232+
case 'ES384': algNamedCurve = 'P-384'; break;
233+
case 'ES512': algNamedCurve = 'P-521'; break;
232234
}
233-
if (curve !== namedCurve)
235+
if (algNamedCurve !== namedCurve)
234236
throw lazyDOMException('Named curve mismatch', 'DataError');
235237
}
236238

test/parallel/test-webcrypto-export-import-cfrg.js

+20
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,26 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable)
259259
message: /key is not extractable/
260260
});
261261
}
262+
263+
for (const crv of [undefined, name === 'Ed25519' ? 'Ed448' : 'Ed25519']) {
264+
await assert.rejects(
265+
subtle.importKey(
266+
'jwk',
267+
{ kty: jwk.kty, x: jwk.x, y: jwk.y, crv },
268+
{ name },
269+
extractable,
270+
publicUsages),
271+
{ message: /Subtype mismatch/ });
272+
273+
await assert.rejects(
274+
subtle.importKey(
275+
'jwk',
276+
{ kty: jwk.kty, d: jwk.d, x: jwk.x, y: jwk.y, crv },
277+
{ name },
278+
extractable,
279+
publicUsages),
280+
{ message: /Subtype mismatch/ });
281+
}
262282
}
263283

264284
(async function() {

test/parallel/test-webcrypto-export-import-ec.js

+20
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,26 @@ async function testImportJwk(
260260
message: /key is not extractable/
261261
});
262262
}
263+
264+
for (const crv of [undefined, namedCurve === 'P-256' ? 'P-384' : 'P-256']) {
265+
await assert.rejects(
266+
subtle.importKey(
267+
'jwk',
268+
{ kty: jwk.kty, x: jwk.x, y: jwk.y, crv },
269+
{ name, namedCurve },
270+
extractable,
271+
publicUsages),
272+
{ message: /Named curve mismatch/ });
273+
274+
await assert.rejects(
275+
subtle.importKey(
276+
'jwk',
277+
{ kty: jwk.kty, d: jwk.d, x: jwk.x, y: jwk.y, crv },
278+
{ name, namedCurve },
279+
extractable,
280+
publicUsages),
281+
{ message: /Named curve mismatch/ });
282+
}
263283
}
264284

265285
(async function() {

0 commit comments

Comments
 (0)