Skip to content

Commit 9f74184

Browse files
committed
crypto: upgrade pbkdf2 without digest to an error
Commit a116358 added a deprecation warning when pbkdf2 was called without an explicit `digest` argument. This was because the default digest is `sha1`, which is not-recommended from a security point of view. This upgrades it to a runtime error when `digest` is undefined per the plan discussed in the original issue. Ref: a116358 PR-URL: #11305 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Fedor Indutny <[email protected]> Reviewed-By: Jeremiah Senkpiel <[email protected]>
1 parent 8bcc122 commit 9f74184

File tree

5 files changed

+22
-15
lines changed

5 files changed

+22
-15
lines changed

doc/api/deprecations.md

+6-3
Original file line numberDiff line numberDiff line change
@@ -115,10 +115,13 @@ to the `constants` property exposed by the relevant module. For instance,
115115
<a id="DEP0009"></a>
116116
### DEP0009: crypto.pbkdf2 without digest
117117

118-
Type: Runtime
118+
Type: End-of-life
119119

120-
Use of the [`crypto.pbkdf2()`][] API without specifying a digest is deprecated.
121-
Please specify a digest.
120+
Use of the [`crypto.pbkdf2()`][] API without specifying a digest was deprecated
121+
in Node.js 6.0 because the method defaulted to using the non-recommendend
122+
`'SHA1'` digest. Previously, a deprecation warning was printed. Starting in
123+
Node.js 8.0.0, calling `crypto.pbkdf2()` or `crypto.pbkdf2Sync()` with an
124+
undefined `digest` will throw a `TypeError`.
122125

123126
<a id="DEP0010"></a>
124127
### DEP0010: crypto.createCredentials

lib/crypto.js

+6-10
Original file line numberDiff line numberDiff line change
@@ -537,11 +537,6 @@ ECDH.prototype.getPublicKey = function getPublicKey(encoding, format) {
537537
};
538538

539539

540-
const pbkdf2DeprecationWarning =
541-
internalUtil.deprecate(() => {}, 'crypto.pbkdf2 without specifying' +
542-
' a digest is deprecated. Please specify a digest', 'DEP0009');
543-
544-
545540
exports.pbkdf2 = function(password,
546541
salt,
547542
iterations,
@@ -551,7 +546,6 @@ exports.pbkdf2 = function(password,
551546
if (typeof digest === 'function') {
552547
callback = digest;
553548
digest = undefined;
554-
pbkdf2DeprecationWarning();
555549
}
556550

557551
if (typeof callback !== 'function')
@@ -562,15 +556,17 @@ exports.pbkdf2 = function(password,
562556

563557

564558
exports.pbkdf2Sync = function(password, salt, iterations, keylen, digest) {
565-
if (typeof digest === 'undefined') {
566-
digest = undefined;
567-
pbkdf2DeprecationWarning();
568-
}
569559
return pbkdf2(password, salt, iterations, keylen, digest);
570560
};
571561

572562

573563
function pbkdf2(password, salt, iterations, keylen, digest, callback) {
564+
565+
if (digest === undefined) {
566+
throw new TypeError(
567+
'The "digest" argument is required and must not be undefined');
568+
}
569+
574570
password = toBuf(password);
575571
salt = toBuf(salt);
576572

test/parallel/test-crypto-domains.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ d.run(function() {
1919
one();
2020

2121
function one() {
22-
crypto.pbkdf2('a', 'b', 1, 8, function() {
22+
crypto.pbkdf2('a', 'b', 1, 8, 'sha1', function() {
2323
two();
2424
throw new Error('pbkdf2');
2525
});

test/parallel/test-crypto-pbkdf2.js

+8
Original file line numberDiff line numberDiff line change
@@ -96,3 +96,11 @@ assert.doesNotThrow(() => {
9696
assert.ifError(e);
9797
}));
9898
});
99+
100+
assert.throws(() => {
101+
crypto.pbkdf2('password', 'salt', 8, 8, function() {});
102+
}, /^TypeError: The "digest" argument is required and must not be undefined$/);
103+
104+
assert.throws(() => {
105+
crypto.pbkdf2Sync('password', 'salt', 8, 8);
106+
}, /^TypeError: The "digest" argument is required and must not be undefined$/);

test/parallel/test-domain-crypto.js

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,4 +19,4 @@ crypto.randomBytes(8);
1919
crypto.randomBytes(8, function() {});
2020
crypto.pseudoRandomBytes(8);
2121
crypto.pseudoRandomBytes(8, function() {});
22-
crypto.pbkdf2('password', 'salt', 8, 8, function() {});
22+
crypto.pbkdf2('password', 'salt', 8, 8, 'sha1', function() {});

0 commit comments

Comments
 (0)