crypto: fix handling of malicious getters (scrypt)
It is possible to bypass parameter validation in crypto.scrypt and crypto.scryptSync by crafting option objects with malicious getters as demonstrated in the regression test. After bypassing validation, any value can be passed to the C++ layer, causing an assertion to crash the process. Fixes: https://github.com/nodejs/node/issues/28836 PR-URL: https://github.com/nodejs/node/pull/28838 Reviewed-By:Michaël Zasso <targos@protonmail.com> Reviewed-By:
Colin Ihrig <cjihrig@gmail.com> Reviewed-By:
Ruben Bridgewater <ruben@bridgewater.de> Reviewed-By:
Sam Roberts <vieuxtech@gmail.com> Reviewed-By:
Rich Trott <rtrott@gmail.com> Reviewed-By:
Luigi Pinca <luigipinca@gmail.com>
parent
31d9b2f1
Please register or sign in to comment