nodejs / nodejs/node

crypto Cipher/Decipher validation issues

Open
#45,189 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

confirmed-bug crypto
Dominant language
JavaScript
Stars
122k
Forks
37.3k
Avg merge
4d 2h
Merged PRs (30d)
283

Description

This also affects Decipher methods.

Here's an example:

const { createCipheriv, randomBytes } = require('crypto');

const cipher = createCipheriv('aes-256-cbc', randomBytes(32), randomBytes(16));

cipher.update('test', 'utf-8', 'bad');

Gives an internal assertion:

Error [ERR_INTERNAL_ASSERTION]: Cannot change encoding
This is caused by either a bug in Node.js or incorrect usage of Node.js internals.
Please open an issue with this stack trace at https://github.com/nodejs/node/issues

final has the same issue:

const { createCipheriv, randomBytes } = require('crypto');

const cipher = createCipheriv('aes-256-cbc', randomBytes(32), randomBytes(16));

cipher.update('test', 'utf-8', 'utf-8');
cipher.final('bad');

Other issue:

const { createCipheriv, randomBytes } = require('crypto');

const cipher = createCipheriv('aes-256-cbc', randomBytes(32), randomBytes(16));

let result = cipher.update('test', 'bad', 'hex');
result += cipher.final('hex');
console.log(result);

Gives no error at all for the wrong input encoding.

@nodejs/crypto

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by running the Cipher and Decipher examples in the issue and inspect the crypto Cipher/Decipher method paths they exercise. Compare the handling of invalid input and output encodings in update and final. Done means invalid encodings receive appropriate validation errors instead of an internal assertion or silent acceptance.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.