thebadking/obscura
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

crypto.subtle.digest: reject unsupported algorithms (#314) (#319)

Browse Source 
Unknown algorithm names (SHA-512/224, MD5, etc.) were silently falling
back to SHA-256, producing wrong bytes with no error. Now throws
DOMException('NotSupportedError') to match Chrome behavior.

Supported: SHA-1, SHA-256, SHA-384, SHA-512.
This commit is contained in:
Gabriel authored and GitHub committed 2026-06-22 13:02:05 +00:00
1 parent a8358cc82d
commit edde67ddd4
2 files changed
+8 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

crates/obscura-js/js/bootstrap.js
Vendored
+4 -7
View File
@@ -6420,13 +6420,10 @@ if (!globalThis.crypto) globalThis.crypto = {};
if (!globalThis.crypto.subtle) {
globalThis.crypto.subtle = {
async digest(algorithm, data) {
// Real WebCrypto digest. Delegates to `op_subtle_digest` which runs
// the actual SHA-1/256/384/512 via Rust's `sha1` and `sha2` crates.
// The previous JS implementation was a custom FNV variant that
// produced bytes shaped like the hash but with wrong contents, so
// SRI checks, JWS signature verification, and OAuth PKCE silently
// accepted invalid input.
const name = (typeof algorithm === 'string' ? algorithm : algorithm?.name) || 'SHA-256';
const name = (typeof algorithm === 'string' ? algorithm : algorithm?.name || '').toUpperCase().replace('_', '-');
if (name !== 'SHA-1' && name !== 'SHA-256' && name !== 'SHA-384' && name !== 'SHA-512') {
throw new DOMException('Unrecognized algorithm name', 'NotSupportedError');
}
let bytes;
if (data instanceof ArrayBuffer) bytes = new Uint8Array(data);
else if (ArrayBuffer.isView(data)) bytes = new Uint8Array(data.buffer, data.byteOffset, data.byteLength);