crypto: handle exceptions in hmac/hash.digest #12164

tniessen · 2017-04-02T13:15:58Z

Hash.digest() and Hmac.digest() lead to a segmentation fault if an error was thrown while converting the encoding parameter to a string, see #9819. As discussed there, we could alternatively handle errors in crypto.cc or drop support for toString() (which is consistent with other core APIs, see #9819 again).

Fixes: #9819

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
tests and/or benchmarks are included
commit message follows commit guidelines

Affected core subsystem(s)

crypto

I prepared a regression test as well but refrained from committing it as it might promote the use of toString() for the encoding parameter, which we might decide not to support in the future.

vsemozhetbyt · 2017-04-02T13:27:40Z

~~Commit message nits:~~

~~Use lower case imperative verb after subsystem prefix (crypto: Handle... -> crypto: handle...)~~
~~Keep line length within 72 characters (line 3 length is 73: Forced conversion of the encoding parameter to a string within crypto.js,).~~

vsemozhetbyt · 2017-04-02T13:29:13Z

CI: https://ci.nodejs.org/job/node-test-pull-request/7163/

Forced conversion of the encoding parameter to a string within crypto.js, fixing segmentation faults in node_crypto.cc. Fixes: nodejs#9819

tniessen · 2017-04-02T14:10:00Z

@vsemozhetbyt Thank you, fixed via force-push. CI looks good.

tniessen · 2017-04-02T20:12:18Z

CI failure might be related to force-push?

Checking out Revision 5418aba66153ba0e14edff53086350805274aa8b (refs/remotes/origin/_jenkins_local_branch)
 > git config core.sparsecheckout # timeout=10
 > git checkout -f 5418aba66153ba0e14edff53086350805274aa8b
FATAL: Could not checkout 5418aba66153ba0e14edff53086350805274aa8b
hudson.plugins.git.GitException: Command "git checkout -f 5418aba66153ba0e14edff53086350805274aa8b" returned status code 128:
stdout: 
stderr: fatal: reference is not a tree: 5418aba66153ba0e14edff53086350805274aa8b

vsemozhetbyt · 2017-04-02T20:19:05Z

New CI: https://ci.nodejs.org/job/node-test-pull-request/7169/

addaleax · 2017-04-03T10:10:59Z

src/node_crypto.cc

-    encoding = ParseEncoding(env->isolate(),
-                             args[0]->ToString(env->isolate()),
-                             BUFFER);
+    encoding = ParseEncoding(env->isolate(), args[0], BUFFER);


Maybe leave a CHECK(args[i]->IsString()); line before the ParseEncoding calls?

If I remember correctly, most functions just ignore invalid encoding values and use the default value instead. Currently, we are forcing the conversion to a string, but just because it is a string doesn't make it a valid encoding value. Adding a CHECK shouldn't do any harm, until we decide to finally drop support for toString() for consistency with other APIs. However, if we do not add a chack and the parameter is not a string (which won't happen now, but might as soon as we decide to drop support for toString()), there won't be any problems, the value will be ignored (ParseEncoding will return instantly).

The above only applies to hmac and hash. For sign and verify, the encoding parameter seems to always be null, so the CHECK would fail, right?

@tniessen Still, if we drop toString() support it’s easy to just drop the checks again. (Likewise, it would be good if you included the test you said you had prepared in this PR – it’s easy to change things later, but for now it’s best to test the current behaviour.)

The above only applies to hmac and hash. For sign and verify, the encoding parameter seems to always be null, so the CHECK would fail, right?

It looks that way, yes… maybe you could fix that up and drop the unused code bits? That also simplifies SignFinal(), right now the StringBytes::Encode() encode call there seems like a completely unnecessary extra copy operation.

@addaleax You are right, I will add the CHECKs and add the regression test.

maybe you could fix that up and drop the unused code bits?

Is it okay to do that in a separate PR or will that create too much organizational overhead?

Is it okay to do that in a separate PR or will that create too much organizational overhead?

That’s your call… you can also maintain multiple commits in a single PR, which may or may not be easier for you. :) I don’t think there are other open pull requests for this code that would generate merge conflicts, and everything we talked about (except maybe dropping toString() support) semver-patch.

I will create a separate PR after this gets merged to avoid conflicts and keep it simple, thank you for your support :)

TimothyGu · 2017-04-03T10:44:05Z

lib/crypto.js

@@ -100,7 +100,8 @@ Hash.prototype.update = function update(data, encoding) {

 Hash.prototype.digest = function digest(outputEncoding) {
  outputEncoding = outputEncoding || exports.DEFAULT_ENCODING;
-  return this._handle.digest(outputEncoding);
+  // Explicit conversion for backward compatibility
+  return this._handle.digest(String(outputEncoding));


Use `${outputEncoding}`; otherwise symbols (which were not allowed) will be converted to string also.

tniessen · 2017-04-03T12:12:15Z

@addaleax I added the checks and the test file, the latter requires to spawn new node processes in order to properly detect segmentation faults (or the lack thereof) as Windows builds seem to silently terminate on segmentation faults instead of producing an error.

jasnell · 2017-04-03T14:27:25Z

test/parallel/test-regress-GH-9819.js

+const scripts = [
+  'crypto.createHash("sha256").digest(enc)',
+  'crypto.createHmac("sha256", "msg").digest(enc)'
+];


Adding the code in a test/fixtures file would be a bit more readable.

Do you mean adding the code as a JSON file or do you mean a JS file which can then be executed within the spawned node process? We are talking about two lines of code here...

Yes, the latter. I'm fine with this the way it is, I'd just generally prefer a fixture. Feel free to ignore tho :-)

Mhhh I think I will keep it this way unless someone expresses a strong opposing opinion, but thank you for your feedback :)

bnoordhuis · 2017-04-04T17:49:06Z

lib/crypto.js

@@ -100,7 +100,8 @@ Hash.prototype.update = function update(data, encoding) {

 Hash.prototype.digest = function digest(outputEncoding) {
  outputEncoding = outputEncoding || exports.DEFAULT_ENCODING;
-  return this._handle.digest(outputEncoding);
+  // Explicit conversion for backward compatibility


Femto-nit: can you punctuate the comment?

addaleax · 2017-04-10T14:41:58Z

Landed in 88351a2, thanks for the PR!

Forced conversion of the encoding parameter to a string within crypto.js, fixing segmentation faults in node_crypto.cc. Fixes: #9819 PR-URL: #12164 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: James M Snell <[email protected]>

Forced conversion of the encoding parameter to a string within crypto.js, fixing segmentation faults in node_crypto.cc. Fixes: nodejs#9819 PR-URL: nodejs#12164 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: James M Snell <[email protected]>

MylesBorins · 2017-04-18T23:51:46Z

I feel like this should maybe bake a bit longer before LTS. Thoughts?

addaleax · 2017-05-15T12:16:05Z

I don’t think this needs to wait longer than usual for LTS.

tniessen · 2017-05-15T14:04:11Z

I don't think we need to rush it in, but it should not cause any trouble either (unless someone depends on segfaults).

jasnell · 2017-05-15T14:44:30Z

This ought to be good to go for LTS at this point.

Forced conversion of the encoding parameter to a string within crypto.js, fixing segmentation faults in node_crypto.cc. Fixes: #9819 PR-URL: #12164 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: James M Snell <[email protected]>

Forced conversion of the encoding parameter to a string within crypto.js, fixing segmentation faults in node_crypto.cc. Fixes: nodejs/node#9819 PR-URL: nodejs/node#12164 Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: Anna Henningsen <[email protected]> Reviewed-By: James M Snell <[email protected]>

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. labels Apr 2, 2017

crypto: handle exceptions in hmac/hash.digest

768c986

Forced conversion of the encoding parameter to a string within crypto.js, fixing segmentation faults in node_crypto.cc. Fixes: nodejs#9819

tniessen force-pushed the fix-9819 branch from 5418aba to 768c986 Compare April 2, 2017 14:03

addaleax approved these changes Apr 3, 2017

View reviewed changes

TimothyGu reviewed Apr 3, 2017

View reviewed changes

tniessen added 2 commits April 3, 2017 13:37

Disallow symbols as encoding

23b71f5

Add checks and regression test

23f95ab

addaleax approved these changes Apr 3, 2017

View reviewed changes

jasnell reviewed Apr 3, 2017

View reviewed changes

jasnell approved these changes Apr 4, 2017

View reviewed changes

bnoordhuis approved these changes Apr 4, 2017

View reviewed changes

Punctuate commit in crypto.js

27d359c

addaleax closed this Apr 10, 2017

addaleax added lts-watch-v4.x labels Apr 10, 2017

italoacasas mentioned this pull request Apr 10, 2017

v7.9.0 Release Proposal #12319

Merged

2 tasks

tniessen mentioned this pull request Apr 13, 2017

crypto: remove unused code in sign/verify #12397

Closed

2 tasks

MylesBorins added land-on-v6.x and removed lts-watch-v4.x labels May 15, 2017

MylesBorins mentioned this pull request May 23, 2017

v6.11.0 proposal #13059

Merged

tniessen changed the title ~~crypto: Handle exceptions in hmac/hash.digest~~ crypto: handle exceptions in hmac/hash.digest Aug 14, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crypto: handle exceptions in hmac/hash.digest #12164

crypto: handle exceptions in hmac/hash.digest #12164

tniessen commented Apr 2, 2017 •

edited

Loading

vsemozhetbyt commented Apr 2, 2017 •

edited

Loading

vsemozhetbyt commented Apr 2, 2017

tniessen commented Apr 2, 2017

tniessen commented Apr 2, 2017

vsemozhetbyt commented Apr 2, 2017

addaleax Apr 3, 2017

tniessen Apr 3, 2017

addaleax Apr 3, 2017

tniessen Apr 3, 2017

addaleax Apr 3, 2017

tniessen Apr 3, 2017

TimothyGu Apr 3, 2017

tniessen commented Apr 3, 2017

jasnell Apr 3, 2017

tniessen Apr 3, 2017 •

edited

Loading

jasnell Apr 4, 2017

tniessen Apr 4, 2017

bnoordhuis Apr 4, 2017

addaleax commented Apr 10, 2017

MylesBorins commented Apr 18, 2017 •

edited

Loading

addaleax commented May 15, 2017

tniessen commented May 15, 2017

jasnell commented May 15, 2017

crypto: handle exceptions in hmac/hash.digest #12164

crypto: handle exceptions in hmac/hash.digest #12164

Conversation

tniessen commented Apr 2, 2017 • edited Loading

Checklist

Affected core subsystem(s)

vsemozhetbyt commented Apr 2, 2017 • edited Loading

vsemozhetbyt commented Apr 2, 2017

tniessen commented Apr 2, 2017

tniessen commented Apr 2, 2017

vsemozhetbyt commented Apr 2, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tniessen commented Apr 3, 2017

Choose a reason for hiding this comment

tniessen Apr 3, 2017 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

addaleax commented Apr 10, 2017

MylesBorins commented Apr 18, 2017 • edited Loading

addaleax commented May 15, 2017

tniessen commented May 15, 2017

jasnell commented May 15, 2017

tniessen commented Apr 2, 2017 •

edited

Loading

vsemozhetbyt commented Apr 2, 2017 •

edited

Loading

tniessen Apr 3, 2017 •

edited

Loading

MylesBorins commented Apr 18, 2017 •

edited

Loading