crypto: use WebIDL converters in WebCryptoAPI

WebCryptoAPI functions' arguments are now coersed and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API.
nodejs · nodejs-github-bot · Jan 17, 2023 · Jan 2, 2023 · Jan 3, 2023 · Jan 3, 2023
commit bc436ebd7ad52c5736832eb57059b631af2bcab4
diff --git a/lib/internal/crypto/aes.js b/lib/internal/crypto/aes.js
@@ -32,7 +32,6 @@ const {
 } = internalBinding('crypto');
 
 const {
-  getArrayBufferOrView,
   hasAnyNotIn,
   jobPromise,
   validateByteLength,
@@ -112,7 +111,6 @@ function getVariant(name, length) {
 }
 
 function asyncAesCtrCipher(mode, key, data, { counter, length }) {
-  counter = getArrayBufferOrView(counter, 'algorithm.counter');
   validateByteLength(counter, 'algorithm.counter', 16);
   // The length must specify an integer between 1 and 128. While
   // there is no default, this should typically be 64.
@@ -135,7 +133,6 @@ function asyncAesCtrCipher(mode, key, data, { counter, length }) {
 }
 
 function asyncAesCbcCipher(mode, key, data, { iv }) {
-  iv = getArrayBufferOrView(iv, 'algorithm.iv');
   validateByteLength(iv, 'algorithm.iv', 16);
   return jobPromise(() => new AESCipherJob(
     kCryptoJobAsync,
@@ -166,12 +163,9 @@ function asyncAesGcmCipher(
       'OperationError'));
   }
 
-  iv = getArrayBufferOrView(iv, 'algorithm.iv');
   validateMaxBufferLength(iv, 'algorithm.iv');
 
   if (additionalData !== undefined) {
-    additionalData =
-      getArrayBufferOrView(additionalData, 'algorithm.additionalData');
     validateMaxBufferLength(additionalData, 'algorithm.additionalData');
   }
 

diff --git a/lib/internal/crypto/cfrg.js b/lib/internal/crypto/cfrg.js
@@ -18,7 +18,6 @@ const {
 } = internalBinding('crypto');
 
 const {
-  getArrayBufferOrView,
   getUsagesUnion,
   hasAnyNotIn,
   jobPromise,
@@ -73,7 +72,6 @@ function verifyAcceptableCfrgKeyUse(name, isPublic, usages) {
 
 function createCFRGRawKey(name, keyData, isPublic) {
   const handle = new KeyObjectHandle();
-  keyData = getArrayBufferOrView(keyData, 'keyData');
 
   switch (name) {
     case 'Ed25519':
@@ -337,8 +335,6 @@ function eddsaSignVerify(key, data, { name, context }, signature) {
     throw lazyDOMException(`Key must be a ${type} key`, 'InvalidAccessError');
 
   if (name === 'Ed448' && context !== undefined) {
-    context =
-      getArrayBufferOrView(context, 'algorithm.context');
     if (context.byteLength !== 0) {
       throw lazyDOMException(
         'Non zero-length context is not yet supported.', 'NotSupportedError');

diff --git a/lib/internal/crypto/diffiehellman.js b/lib/internal/crypto/diffiehellman.js
@@ -48,7 +48,6 @@ const {
 
 const {
   KeyObject,
-  isCryptoKey,
 } = require('internal/crypto/keys');
 
 const {
@@ -324,8 +323,6 @@ async function ecdhDeriveBits(algorithm, baseKey, length) {
   // give us everything that is generated.
   if (length !== null)
     validateUint32(length, 'length');
-  if (!isCryptoKey(key))
-    throw new ERR_INVALID_ARG_TYPE('algorithm.public', 'CryptoKey', key);
 
   if (key.type !== 'public') {
     throw lazyDOMException(

diff --git a/lib/internal/crypto/ec.js b/lib/internal/crypto/ec.js
@@ -24,7 +24,6 @@ const {
 } = require('internal/errors');
 
 const {
-  getArrayBufferOrView,
   getUsagesUnion,
   hasAnyNotIn,
   jobPromise,
@@ -76,7 +75,6 @@ function verifyAcceptableEcKeyUse(name, isPublic, usages) {
 
 function createECPublicKeyRaw(namedCurve, keyData) {
   const handle = new KeyObjectHandle();
-  keyData = getArrayBufferOrView(keyData, 'keyData');
 
   if (!handle.initECRaw(kNamedCurveAliases[namedCurve], keyData)) {
     throw lazyDOMException('Invalid keyData', 'DataError');

diff --git a/lib/internal/crypto/hash.js b/lib/internal/crypto/hash.js
@@ -14,11 +14,9 @@ const {
 } = internalBinding('crypto');
 
 const {
-  getArrayBufferOrView,
   getDefaultEncoding,
   getStringOption,
   jobPromise,
-  normalizeAlgorithm,
   normalizeHashName,
   validateMaxBufferLength,
   kHandle,
@@ -168,13 +166,8 @@ Hmac.prototype._transform = Hash.prototype._transform;
 // Implementation for WebCrypto subtle.digest()
 
 async function asyncDigest(algorithm, data) {
-  algorithm = normalizeAlgorithm(algorithm);
-  data = getArrayBufferOrView(data, 'data');
   validateMaxBufferLength(data, 'data');
 
-  if (algorithm.length !== undefined)
-    validateUint32(algorithm.length, 'algorithm.length');
-
   switch (algorithm.name) {
     case 'SHA-1':
       // Fall through
@@ -186,8 +179,7 @@ async function asyncDigest(algorithm, data) {
       return jobPromise(() => new HashJob(
         kCryptoJobAsync,
         normalizeHashName(algorithm.name),
-        data,
-        algorithm.length));
+        data));
   }
 
   throw lazyDOMException('Unrecognized name.', 'NotSupportedError');

diff --git a/lib/internal/crypto/hkdf.js b/lib/internal/crypto/hkdf.js
@@ -19,7 +19,6 @@ const {
 const { kMaxLength } = require('buffer');
 
 const {
-  getArrayBufferOrView,
   normalizeHashName,
   toBuf,
   validateByteSource,
@@ -45,7 +44,6 @@ const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_OUT_OF_RANGE,
-    ERR_MISSING_OPTION,
   },
   hideStackFrames,
 } = require('internal/errors');
@@ -140,11 +138,7 @@ function hkdfSync(hash, key, salt, info, length) {
 
 const hkdfPromise = promisify(hkdf);
 async function hkdfDeriveBits(algorithm, baseKey, length) {
-  const { hash } = algorithm;
-  const salt = getArrayBufferOrView(algorithm.salt, 'algorithm.salt');
-  const info = getArrayBufferOrView(algorithm.info, 'algorithm.info');
-  if (hash === undefined)
-    throw new ERR_MISSING_OPTION('algorithm.hash');
+  const { hash, salt, info } = algorithm;
 
   if (length === 0)
     throw lazyDOMException('length cannot be zero', 'OperationError');

diff --git a/lib/internal/crypto/pbkdf2.js b/lib/internal/crypto/pbkdf2.js
@@ -15,12 +15,9 @@ const {
 const {
   validateFunction,
   validateInt32,
-  validateInteger,
   validateString,
 } = require('internal/validators');
 
-const { ERR_MISSING_OPTION } = require('internal/errors').codes;
-
 const {
   getArrayBufferOrView,
   getDefaultEncoding,
@@ -101,19 +98,12 @@ function check(password, salt, iterations, keylen, digest) {
 
 const pbkdf2Promise = promisify(pbkdf2);
 async function pbkdf2DeriveBits(algorithm, baseKey, length) {
-  const { iterations } = algorithm;
-  let { hash } = algorithm;
-  const salt = getArrayBufferOrView(algorithm.salt, 'algorithm.salt');
-  if (hash === undefined)
-    throw new ERR_MISSING_OPTION('algorithm.hash');
-  validateInteger(iterations, 'algorithm.iterations');
+  const { iterations, hash, salt } = algorithm;
   if (iterations === 0)
     throw lazyDOMException(
       'iterations cannot be zero',
       'OperationError');
 
-  hash = normalizeHashName(hash.name);
-
   const raw = baseKey[kKeyObject].export();
 
   if (length === 0)
@@ -128,7 +118,9 @@ async function pbkdf2DeriveBits(algorithm, baseKey, length) {
 
   let result;
   try {
-    result = await pbkdf2Promise(raw, salt, iterations, length / 8, hash);
+    result = await pbkdf2Promise(
+      raw, salt, iterations, length / 8, normalizeHashName(hash.name),
+    );
   } catch (err) {
     throw lazyDOMException(
       'The operation failed for an operation-specific reason',

diff --git a/lib/internal/crypto/random.js b/lib/internal/crypto/random.js
@@ -40,7 +40,6 @@ const { Buffer, kMaxLength } = require('buffer');
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
-    ERR_MISSING_ARGS,
     ERR_OUT_OF_RANGE,
     ERR_OPERATION_FAILED,
   }
@@ -316,8 +315,6 @@ function onJobDone(buf, callback, error) {
 // not allowed to exceed 65536 bytes, and can only
 // be an integer-type TypedArray.
 function getRandomValues(data) {
-  if (arguments.length < 1)
-    throw new ERR_MISSING_ARGS('typedArray');
   if (!isTypedArray(data) ||
       isFloat32Array(data) ||
       isFloat64Array(data)) {

diff --git a/lib/internal/crypto/rsa.js b/lib/internal/crypto/rsa.js
@@ -35,7 +35,6 @@ const {
 
 const {
   bigIntArrayToUnsignedInt,
-  getArrayBufferOrView,
   getUsagesUnion,
   hasAnyNotIn,
   jobPromise,
@@ -104,7 +103,6 @@ function rsaOaepCipher(mode, key, data, { label }) {
       'InvalidAccessError');
   }
   if (label !== undefined) {
-    label = getArrayBufferOrView(label, 'algorithm.label');
     validateMaxBufferLength(label, 'algorithm.label');
   }