crypto: validate CFRG webcrypto JWK import "d" and "x" are a pair

PR-URL: #45569 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: Tobias Nießen <[email protected]>
nodejs · Jan 3, 2023 · b92b804 · b92b804
1 parent 621e3c9
commit b92b804
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 41 deletions.
diff --git a/lib/internal/crypto/cfrg.js b/lib/internal/crypto/cfrg.js
@@ -300,12 +300,24 @@ async function cfrgImportKey(
         name,
         isPublic ? 'public' : 'private',
         usagesSet);
-      keyObject = createCFRGRawKey(
+
+      const publicKeyObject = createCFRGRawKey(
         name,
-        Buffer.from(
-          isPublic ? keyData.x : keyData.d,
-          'base64'),
-        isPublic);
+        Buffer.from(keyData.x, 'base64'),
+        true);
+
+      if (isPublic) {
+        keyObject = publicKeyObject;
+      } else {
+        keyObject = createCFRGRawKey(
+          name,
+          Buffer.from(keyData.d, 'base64'),
+          false);
+
+        if (!createPublicKey(keyObject).equals(publicKeyObject)) {
+          throw lazyDOMException('Invalid JWK keyData', 'DataError');
+        }
+      }
       break;
     }
     case 'raw': {

diff --git a/test/wpt/status/WebCryptoAPI.json b/test/wpt/status/WebCryptoAPI.json
@@ -7,41 +7,5 @@
   },
   "idlharness.https.any.js": {
     "skip": "Various non-IDL-compliant things"
-  },
-  "import_export/okp_importKey_failures_Ed25519.https.any.js": {
-    "fail": {
-      "expected": [
-        "Invalid key pair: importKey(jwk(private), {name: Ed25519}, true, [sign])",
-        "Invalid key pair: importKey(jwk(private), {name: Ed25519}, true, [sign, sign])"
-      ]
-    }
-  },
-  "import_export/okp_importKey_failures_Ed448.https.any.js": {
-    "fail": {
-      "expected": [
-        "Invalid key pair: importKey(jwk(private), {name: Ed448}, true, [sign])",
-        "Invalid key pair: importKey(jwk(private), {name: Ed448}, true, [sign, sign])"
-      ]
-    }
-  },
-  "import_export/okp_importKey_failures_X25519.https.any.js": {
-    "fail": {
-      "expected": [
-        "Invalid key pair: importKey(jwk(private), {name: X25519}, true, [deriveKey])",
-        "Invalid key pair: importKey(jwk(private), {name: X25519}, true, [deriveBits, deriveKey])",
-        "Invalid key pair: importKey(jwk(private), {name: X25519}, true, [deriveBits])",
-        "Invalid key pair: importKey(jwk(private), {name: X25519}, true, [deriveKey, deriveBits, deriveKey, deriveBits])"
-      ]
-    }
-  },
-  "import_export/okp_importKey_failures_X448.https.any.js": {
-    "fail": {
-      "expected": [
-        "Invalid key pair: importKey(jwk(private), {name: X448}, true, [deriveKey])",
-        "Invalid key pair: importKey(jwk(private), {name: X448}, true, [deriveBits, deriveKey])",
-        "Invalid key pair: importKey(jwk(private), {name: X448}, true, [deriveBits])",
-        "Invalid key pair: importKey(jwk(private), {name: X448}, true, [deriveKey, deriveBits, deriveKey, deriveBits])"
-      ]
-    }
   }
 }