fix: reject SharedArrayBuffer in WebCrypto and getRandomValues#1019
Merged
Conversation
Per WebCrypto / Web IDL §BufferSource, SharedArrayBuffer-backed inputs must be rejected from all subtle.* methods and getRandomValues: concurrent writes from another worker during async crypto can race with the algorithm, corrupting output or leaking intermediate state. Even copying the source isn't safe — the copy itself races. Add `rejectSharedArrayBuffer` in conversion.ts and wire it into abvToArrayBuffer / bufferLikeToArrayBuffer / binaryLikeToArrayBuffer so every WebCrypto entry point and randomFill* path rejects both raw SAB and SAB-backed views with TypeError, matching Node's WebIDL BufferSource converter (commit bee10872588). Also call it explicitly at the top of getRandomValues so SAB rejection precedes the TypeMismatchError / QuotaExceededError checks per spec ordering.
Adds two tests verifying SharedArrayBuffer-backed inputs are rejected at the AES-GCM `additionalData` and AES-CTR `counter` parameters, both of which flow through `bufferLikeToArrayBuffer` like other BufferSource fields. Also documents that the SAB guard intentionally applies to classic crypto APIs too (stricter than Node) since the TOCTOU concern is identical, and clarifies in `getRandomValues` that the explicit `rejectSharedArrayBuffer` call is load-bearing for WebIDL error-type ordering, not redundant. Replaces an `as never` cast in the deriveBits test with a typed `satisfies HkdfAlgorithm` literal.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
🤖 End-to-End Test Results - iOSStatus: ✅ Passed 📸 Final Test ScreenshotScreenshot automatically captured from End-to-End tests and will expire in 30 days This comment is automatically updated on each test run. |
Contributor
🤖 End-to-End Test Results - AndroidStatus: ✅ Passed 📸 Final Test ScreenshotScreenshot automatically captured from End-to-End tests and will expire in 30 days This comment is automatically updated on each test run. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rejects
SharedArrayBufferand SAB-backed views from WebCrypto (subtle.*) andgetRandomValuesper WebIDL §BufferSource — concurrent writes from another worker during async crypto can race with the algorithm and corrupt output or leak intermediate state, so even copying the source isn't safe (the copy itself races). ThrowsTypeError, matching Node'slib/internal/webidl.jsBufferSource converter (Node commitbee10872588) and the W3C WebCrypto spec.Changes
rejectSharedArrayBuffer(buf)helper inutils/conversion.tsthat throwsTypeErrorfor rawSharedArrayBufferinputs and views backed by one.abvToArrayBuffer(random ops),bufferLikeToArrayBuffer(subtle.* ops), andbinaryLikeToArrayBuffer(key material).getRandomValuesso the WebIDLTypeErroris thrown before the WebCrypto-specificTypeMismatchError/QuotaExceededErrorchecks — load-bearing for spec error-type ordering, not redundant.bufferLikeToArrayBuffer, which had a TOCTOU race during the copy itself.createHash().update,createHmac().update,createCipheriv().update, etc.) accept SAB-backed views, but the same race concern applies on either side of the WebCrypto / classic line, so we apply the safer default everywhere.Testing
New test suite
subtle.sharedarraybuffer-rejection(16 tests) covers raw SAB and SAB-backed views across:getRandomValuescrypto.randomFill/randomFillSyncsubtle.digest(data — view + raw SAB)subtle.encrypt/decrypt(plaintext, iv, ciphertext, AES-GCMadditionalData, AES-CTRcounter)subtle.sign/verify(data, signature)subtle.importKey(raw key)subtle.deriveBits(HKDF salt)Suite skips cleanly on hosts that don't expose
SharedArrayBuffer(older Hermes builds).Test plan
closes #999