Commit 499533f7 authored by Tobias Nießen's avatar Tobias Nießen Committed by Rich Trott
Browse files

crypto: fix handling of malicious getters (scrypt)

It is possible to bypass parameter validation in crypto.scrypt and
crypto.scryptSync by crafting option objects with malicious getters as
demonstrated in the regression test. After bypassing validation, any
value can be passed to the C++ layer, causing an assertion to crash
the process.

Fixes: https://github.com/nodejs/node/issues/28836

PR-URL: https://github.com/nodejs/node/pull/28838


Reviewed-By: default avatarMichaël Zasso <targos@protonmail.com>
Reviewed-By: default avatarColin Ihrig <cjihrig@gmail.com>
Reviewed-By: default avatarRuben Bridgewater <ruben@bridgewater.de>
Reviewed-By: default avatarSam Roberts <vieuxtech@gmail.com>
Reviewed-By: default avatarRich Trott <rtrott@gmail.com>
Reviewed-By: default avatarLuigi Pinca <luigipinca@gmail.com>
parent 31d9b2f1
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment