mirror of
https://github.com/nodejs/node.git
synced 2025-05-15 06:18:09 +00:00
e673c03629
Using the JavaScript Hash class is unsafe because its internals can be tampered with. In particular, an application can cause Hash.prototype.digest() to return arbitrary values, thus allowing to circumvent the integrity verification that policies are supposed to guarantee. Add and use a new C++ binding internalVerifyIntegrity() that (hopefully) cannot be tampered with from JavaScript. PR-URL: https://github.com/nodejs-private/node-private/pull/462 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> CVE-ID: CVE-2023-38552
22 lines
708 B
JavaScript
22 lines
708 B
JavaScript
'use strict';
|
|
|
|
const common = require('../common');
|
|
if (!common.hasCrypto)
|
|
common.skip('missing crypto');
|
|
common.requireNoPackageJSONAbove();
|
|
|
|
const fixtures = require('../common/fixtures');
|
|
|
|
const assert = require('assert');
|
|
const { spawnSync } = require('child_process');
|
|
|
|
const mainPath = fixtures.path('policy', 'crypto-hash-tampering', 'main.js');
|
|
const policyPath = fixtures.path(
|
|
'policy',
|
|
'crypto-hash-tampering',
|
|
'policy.json');
|
|
const { status, stderr } =
|
|
spawnSync(process.execPath, ['--experimental-policy', policyPath, mainPath], { encoding: 'utf8' });
|
|
assert.strictEqual(status, 1);
|
|
assert(stderr.includes('sha384-Bnp/T8gFNzT9mHj2G/AeuMH8LcAQ4mljw15nxBNl5yaGM7VgbMzDT7O4+dXZTJJn'));
|