Handle Invalid Digest header algorithm

dist/index.cjs

@@ -838,7 +838,18 @@ async function verifyRFC3230DigestHeader(request, rawBody, failOnNoDigest = true
       errorLogger(`Invalid Digest header algorithm: ${match[1]}`);
     return false;
   }
-  const hash = await createBase64Digest(rawBody, algo);
+  let hash;
+  try {
+    hash = await createBase64Digest(rawBody, algo);
+  } catch (e) {
+    if (e.name === "NotSupportedError") {
+      if (errorLogger)
+        errorLogger(`Invalid Digest header algorithm: ${algo}`);
+      return false;
+    }
+    throw e;
+  }
+  ;
   if (hash !== value) {
     if (errorLogger)
       errorLogger(`Digest header hash mismatch`);

dist/index.mjs

@@ -741,7 +741,18 @@ async function verifyRFC3230DigestHeader(request, rawBody, failOnNoDigest = true
       errorLogger(`Invalid Digest header algorithm: ${match[1]}`);
     return false;
   }
-  const hash = await createBase64Digest(rawBody, algo);
+  let hash;
+  try {
+    hash = await createBase64Digest(rawBody, algo);
+  } catch (e) {
+    if (e.name === "NotSupportedError") {
+      if (errorLogger)
+        errorLogger(`Invalid Digest header algorithm: ${algo}`);
+      return false;
+    }
+    throw e;
+  }
+  ;
   if (hash !== value) {
     if (errorLogger)
       errorLogger(`Digest header hash mismatch`);

dist/pem/pkcs8.d.ts

@@ -6,8 +6,6 @@ export declare class Pkcs8ParseError extends Error {
 export type ParsedPkcs8 = ParsedAlgorithmIdentifierBase & {
     /**
      * DER
-     *
-     * (Somehow crypto.createPublicKey will cause `error:1E08010C:DECODER routines::unsupported`)
      */
     der: ArrayBuffer;
     attributesRaw: ArrayBuffer | null;

dist/pem/spki.d.ts

@@ -7,7 +7,7 @@ export declare class SpkiParseError extends Error {
  * Get algorithm name from OID
  * https://datatracker.ietf.org/doc/html/rfc3279#section-2.3
  * https://datatracker.ietf.org/doc/html/rfc8420#appendix-A
- * @param oidStr e.g. '1.2.840.113549.1.1.1' or SpkiParsedAlgorithmIdentifier.algorithm
+ * @param oidStr e.g. '1.2.840.113549.1.1.1' or ParsedAlgorithmIdentifier.algorithm
  * @returns e.g. 'RSASSA-PKCS1-v1_5'
  */
 export declare function getPublicKeyAlgorithmNameFromOid(oidStr: string): KeyAlgorithmName;
@@ -78,6 +78,15 @@ export declare function parseAlgorithmIdentifier(input: ASN1): ParsedAlgorithmId
 export declare function parseSpki(input: ASN1.StreamOrBinary): SpkiParsedAlgorithmIdentifier;
 /**
  * Parse X.509 SubjectPublicKeyInfo (SPKI) public key
+ *
+ * In Node.js, `createPublicKey(publicKey)` does not need any information,
+ * but `crypto.subtle.importKey` needs to be provided by us for the key type.
+ *
+ * So, this function parses the SPKI and parses the type of key stored.
+ *
+ * If the key is PKCS#1, the function wraps it in SPKI. In that case,
+ * it assumes that the algorithm is `RSASSA-PKCS1-v1_5`.
+ *
  * @param input SPKI public key PEM or DER
  * @returns parsed object
  */

src/digest/digest-rfc3230.test.ts

@@ -45,6 +45,14 @@ describe('rfc3230', () => {
 			} as any;
 			expect(await verifyRFC3230DigestHeader(request, 'foo')).toBe(true);
 		});
+		test('Unrecognized algorithm name', async () => {
+			const request = {
+				headers: {
+					'digest': `FOO=${await createBase64Digest('foo', 'SHA-256')}`,
+				},
+			} as any;
+			expect(await verifyRFC3230DigestHeader(request, 'foo')).toBe(false);
+		});
 	});
 });
 

src/digest/digest-rfc3230.ts

@@ -44,7 +44,17 @@ export async function verifyRFC3230DigestHeader(
 		return false;
 	}
 
-	const hash = await createBase64Digest(rawBody, algo);
+	let hash: string;
+	try {
+		hash = await createBase64Digest(rawBody, algo);
+	} catch (e: any) {
+		if (e.name === 'NotSupportedError') {
+			if (errorLogger) errorLogger(`Invalid Digest header algorithm: ${algo}`);
+			return false;
+		}
+		throw e;
+	}
+
 	if (hash !== value) {
 		if (errorLogger) errorLogger(`Digest header hash mismatch`);
 		return false;