cloudflare / cloudflare/workerd
`crypto.subtle.exportKey()` returns absent `JsonWebKey` members as enumerable `undefined` properties
- Dominant language
- C++
- Stars
- 8.7k
- Forks
- 739
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 174
Description
```js
export default {
async test() {
const { publicKey } = await crypto.subtle.generateKey(
{ name: 'ECDSA', namedCurve: 'P-256' },
true,
['sign', 'verify'],
)
const jwk = await crypto.subtle.exportKey('jwk', publicKey)
console.log(Object.keys(jwk))
console.log(Object.hasOwn(jwk, 'd'))
console.log(typeof jwk.d)
},
}
```
### Actual result
```js
[
'kty',
'use',
'key_ops',
'alg',
'ext',
'crv',
'x',
'y',
'd',
'n',
'e',
'p',
'q',
'dp',
'dq',
'qi',
'oth',
'k',
]
Object.hasOwn(jwk, 'd') === true
typeof jwk.d === 'undefined'
```
Every member of the `JsonWebKey` dictionary is materialized as an enumerable own property. Members that do not apply to the exported key have the value `undefined`.
### Expected result
Only dictionary members that are actually present should become properties of the returned JavaScript object.
The Web Cryptography export ops set `properties` explicitly.
Contributor guide
Research direction
Start at the crypto.subtle.exportKey() implementation and follow how the Web Cryptography export operations populate properties. Reproduce the ECDSA JWK example from the issue, inspect Object.keys(), Object.hasOwn(), and typeof for absent members, and confirm that only applicable dictionary members are enumerable properties when done.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, javascript
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 70/100