crypto: read WebCrypto inputs through primordials

BufferSource conversion hands over the caller's own object uncopied, so
byteLength, byteOffset, buffer and length reads on it run
user-replaceable prototype accessors. Internal lookup tables are indexed
with computed keys, so a polluted %Object.prototype% key answers a miss.
The %Set% constructor iterates its argument through the user-mutable
%Array.prototype% iterator.

The algorithm registry and the hash name tables are detached from
%Object.prototype% after construction rather than declared
`__proto__: null`, which V8 places in dictionary mode.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #65115
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Aviv Keller <me@aviv.sh>

Author: panva

lib/internal/crypto/aes.js

@@ -24,6 +24,7 @@ const {
 const {
   getUsagesMask,
   jobPromise,
+  getBufferSourceByteLength,
 } = require('internal/crypto/util');
 
 const {
@@ -218,7 +219,7 @@ function aesImportKey(
       if (format === 'raw' && name === 'AES-OCB') {
         return undefined;
       }
-      length = keyData.byteLength * 8;
+      length = getBufferSourceByteLength(keyData) * 8;
       validateKeyLength(length);
       handle = importSecretKey(keyData);
       break;

lib/internal/crypto/cfrg.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  SafeSet,
   StringPrototypeToLowerCase,
   TypedArrayPrototypeGetBuffer,
 } = primordials;
@@ -29,6 +28,7 @@ const {
 const {
   getUsagesMask,
   jobPromise,
+  toUsagesSet,
 } = require('internal/crypto/util');
 
 const {
@@ -126,7 +126,7 @@ function cfrgImportKey(
   const { name } = algorithm;
   let handle;
   const allowedUsages = kUsages[name];
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   switch (format) {
     case 'KeyObjectHandle':
       verifyAcceptableKeyUse(

lib/internal/crypto/diffiehellman.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const {
+  ArrayBufferPrototypeGetByteLength,
   ArrayBufferPrototypeSlice,
   FunctionPrototypeCall,
   ObjectDefineProperty,
@@ -410,7 +411,7 @@ function ecdhDeriveBits(algorithm, baseKey, length) {
   return jobPromiseThen(bits, (bits) => {
     const sliceLength = numBitsToBytes(length);
 
-    const { byteLength } = bits;
+    const byteLength = ArrayBufferPrototypeGetByteLength(bits);
     // If the length is larger than the derived secret, throw.
     if (byteLength < sliceLength)
       throw lazyDOMException('derived bit length is too small', 'OperationError');

lib/internal/crypto/ec.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  SafeSet,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
 } = primordials;
@@ -33,6 +32,7 @@ const {
   jobPromise,
   normalizeHashName,
   kNamedCurveAliases,
+  toUsagesSet,
 } = require('internal/crypto/util');
 
 const {
@@ -142,7 +142,7 @@ function ecImportKey(
 
   let handle;
   const allowedUsages = kUsages[name];
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   switch (format) {
     case 'KeyObjectHandle':
       verifyAcceptableKeyUse(
@@ -215,7 +215,8 @@ function ecImportKey(
     throw lazyDOMException('Invalid keyData', 'DataError');
   }
 
-  if (kNamedCurveAliases[namedCurve] !== handle.keyDetail({}).namedCurve)
+  if (kNamedCurveAliases[namedCurve] !==
+      handle.keyDetail({ __proto__: null }).namedCurve)
     throw lazyDOMException('Named curve mismatch', 'DataError');
 
   return new InternalCryptoKey(

lib/internal/crypto/hash.js

@@ -31,6 +31,7 @@ const {
   kHandle,
   getCachedHashId,
   getHashCache,
+  getOptionalByteLength,
 } = require('internal/crypto/util');
 
 const {
@@ -236,8 +237,8 @@ function asyncDigest(algorithm, data) {
       // Fall through
     case 'cSHAKE256': {
       const outputLength = algorithm.outputLength;
-      if (algorithm.functionName?.byteLength ||
-          algorithm.customization?.byteLength) {
+      if (getOptionalByteLength(algorithm.functionName) ||
+          getOptionalByteLength(algorithm.customization)) {
         if (CShakeJob === undefined) {
           throw lazyDOMException(
             'Non-empty CShakeParams functionName or customization is not supported',

lib/internal/crypto/hashnames.js

@@ -2,6 +2,7 @@
 
 const {
   ObjectKeys,
+  ObjectSetPrototypeOf,
 } = primordials;
 
 const kHashContextNode = 1;
@@ -71,15 +72,22 @@ const kHashNames = {
   },
 };
 
+// Both tables are indexed with computed keys, so a polluted %Object.prototype%
+// key must not answer a miss. Detached here rather than declared
+// `__proto__: null`: V8 puts that literal form in dictionary mode.
+ObjectSetPrototypeOf(kHashNames, null);
+
 {
   // Index the aliases
   const keys = ObjectKeys(kHashNames);
   for (let n = 0; n < keys.length; n++) {
-    const contexts = ObjectKeys(kHashNames[keys[n]]);
+    const entry = kHashNames[keys[n]];
+    ObjectSetPrototypeOf(entry, null);
+    const contexts = ObjectKeys(entry);
     for (let i = 0; i < contexts.length; i++) {
-      const alias = kHashNames[keys[n]][contexts[i]];
+      const alias = entry[contexts[i]];
       if (kHashNames[alias] === undefined)
-        kHashNames[alias] = kHashNames[keys[n]];
+        kHashNames[alias] = entry;
     }
   }
 }

lib/internal/crypto/keys.js

@@ -5,7 +5,6 @@ const {
   ObjectDefineProperties,
   ObjectPrototypeHasOwnProperty,
   ObjectSetPrototypeOf,
-  SafeSet,
   StringPrototypeIncludes,
   StringPrototypeStartsWith,
   SymbolToStringTag,
@@ -68,6 +67,7 @@ const {
   getUsagesMask,
   getUsagesFromMask,
   hasUsage,
+  toUsagesSet,
 } = require('internal/crypto/util');
 
 const {
@@ -1332,7 +1332,7 @@ function importGenericSecretKey(
   extractable,
   keyUsages,
 ) {
-  const usagesSet = new SafeSet(keyUsages);
+  const usagesSet = toUsagesSet(keyUsages);
   const { name } = algorithm;
   if (extractable)
     throw lazyDOMException(`${name} keys are not extractable`, 'SyntaxError');

lib/internal/crypto/ml_dsa.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  SafeSet,
   StringPrototypeToLowerCase,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeSet,
@@ -31,6 +30,8 @@ const {
 const {
   getUsagesMask,
   jobPromise,
+  toUsagesSet,
+  getBufferSourceByteLength,
 } = require('internal/crypto/util');
 
 const {
@@ -130,7 +131,7 @@ function mlDsaImportKey(
 
   const { name } = algorithm;
   let handle;
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   switch (format) {
     case 'KeyObjectHandle':
       verifyAcceptableKeyUse(
@@ -155,7 +156,7 @@ function mlDsaImportKey(
         'ML-DSA-65': 4060,
         'ML-DSA-87': 4924,
       };
-      if (keyData.byteLength === privOnlyLengths[name]) {
+      if (getBufferSourceByteLength(keyData) === privOnlyLengths[name]) {
         throw lazyDOMException(
           'Importing an ML-DSA PKCS#8 key without a seed is not supported',
           'NotSupportedError');

lib/internal/crypto/ml_kem.js

@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  SafeSet,
   StringPrototypeToLowerCase,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeSet,
@@ -28,6 +27,8 @@ const {
 const {
   getUsagesMask,
   jobPromise,
+  toUsagesSet,
+  getBufferSourceByteLength,
 } = require('internal/crypto/util');
 
 const {
@@ -129,7 +130,7 @@ function mlKemImportKey(
 
   const { name } = algorithm;
   let handle;
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   switch (format) {
     case 'KeyObjectHandle':
       verifyAcceptableKeyUse(
@@ -154,7 +155,7 @@ function mlKemImportKey(
         'ML-KEM-768': 2428,
         'ML-KEM-1024': 3196,
       };
-      if (keyData.byteLength === privOnlyLengths[name]) {
+      if (getBufferSourceByteLength(keyData) === privOnlyLengths[name]) {
         throw lazyDOMException(
           'Importing an ML-KEM PKCS#8 key without a seed is not supported',
           'NotSupportedError');

lib/internal/crypto/rsa.js

@@ -2,7 +2,6 @@
 
 const {
   MathCeil,
-  SafeSet,
   TypedArrayPrototypeGetBuffer,
   Uint8Array,
 } = primordials;
@@ -35,6 +34,7 @@ const {
   jobPromise,
   normalizeHashName,
   validateMaxBufferLength,
+  toUsagesSet,
 } = require('internal/crypto/util');
 
 const {
@@ -174,7 +174,7 @@ function rsaImportKey(
   extractable,
   usages) {
   const allowedUsages = kUsages[algorithm.name];
-  const usagesSet = new SafeSet(usages);
+  const usagesSet = toUsagesSet(usages);
   let handle;
   switch (format) {
     case 'KeyObjectHandle':
@@ -234,7 +234,7 @@ function rsaImportKey(
   const {
     modulusLength,
     publicExponent,
-  } = handle.keyDetail({});
+  } = handle.keyDetail({ __proto__: null });
 
   return new InternalCryptoKey(handle, {
     name: algorithm.name,