cloudflare / cloudflare/workerd

`crypto.subtle.exportKey()` returns absent `JsonWebKey` members as enumerable `undefined` properties

Open
#6,892 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8.7k
Forks
739
Avg merge
2d 20h
Merged PRs (30d)
174

Description

```js
export default {
async test() {
const { publicKey } = await crypto.subtle.generateKey(
{ name: 'ECDSA', namedCurve: 'P-256' },
true,
['sign', 'verify'],
)

const jwk = await crypto.subtle.exportKey('jwk', publicKey)

console.log(Object.keys(jwk))
console.log(Object.hasOwn(jwk, 'd'))
console.log(typeof jwk.d)
},
}
```

### Actual result

```js
[
'kty',
'use',
'key_ops',
'alg',
'ext',
'crv',
'x',
'y',
'd',
'n',
'e',
'p',
'q',
'dp',
'dq',
'qi',
'oth',
'k',
]

Object.hasOwn(jwk, 'd') === true
typeof jwk.d === 'undefined'
```

Every member of the `JsonWebKey` dictionary is materialized as an enumerable own property. Members that do not apply to the exported key have the value `undefined`.

### Expected result

Only dictionary members that are actually present should become properties of the returned JavaScript object.

The Web Cryptography export ops set `properties` explicitly.

Contributor guide

Open the contributing guide

Research direction

Start at the crypto.subtle.exportKey() implementation and follow how the Web Cryptography export operations populate properties. Reproduce the ECDSA JWK example from the issue, inspect Object.keys(), Object.hasOwn(), and typeof for absent members, and confirm that only applicable dictionary members are enumerable properties when done.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, javascript
Domain
api, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
70/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.