Skip to content

Commit

Permalink
Always return a boolean from NodeRSA.isPrivate
Browse files Browse the repository at this point in the history
Currently, the `NodeRSA.isPrivate` method returns the `d` component of
the key when the key is indeed a private key. Obviously, this result
is truthy and hence does the job. However, I would classify it as a
security risk since the name `isPrivate` raises the expectation that
the result is a boolean and hence can safely be sent over the wire.
This might leak the most private part of the key though, which would
most likely be a disaster.
  • Loading branch information
hurryabit committed Mar 20, 2020
1 parent 14dcb98 commit d6e4e97
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/libs/rsa.js
Original file line number Diff line number Diff line change
Expand Up @@ -272,7 +272,7 @@ module.exports.Key = (function () {
* Check if key pair contains private key
*/
RSAKey.prototype.isPrivate = function () {
return this.n && this.e && this.d || false;
return this.n && this.e && this.d && true || false;
};

/**
Expand Down

0 comments on commit d6e4e97

Please sign in to comment.