Evaluate Alternative Crypto Libraries for Safe Mode in Bruno (QuickJS Compatibility)

[helloanoop]

We are planning to remove support for crypto-js in Safe Mode. Previously, we used version 3.x (which is being flagged for vulnerabilities), which worked without relying on Node.js or browser APIs. However, newer versions of crypto-js introduce dependencies that are incompatible with the QuickJS runtime, which lacks support for these APIs.

To maintain crypto capabilities in Safe Mode, we are considering adopting SJCL (Stanford Javascript Crypto Library) as a core crypto library. SJCL is written in pure JavaScript, has no external dependencies, and supports essential operations like:

• AES encryption/decryption
• SHA hashing (SHA-1, SHA-256, etc.)
• HMAC generation
• PBKDF2

We’re looking for feedback on this direction, and suggestions for any other crypto libraries that:

• Are implemented in pure JavaScript
• Do not depend on Node.js built-ins or browser-specific APIs (e.g., Web Crypto)
• Can run inside the QuickJS runtime

JIRA

[PramodKumarYadav]

@helloanoop : Do we have an ETA for above ticket, since we would like to roll out Bruno to teams and this is a blocker to use Bruno CLI in CI as explained here: #3376.

[bjdawson]

I would be careful about using SJCL as it looks like it is a dead project (no commit in over 6 years!). Doing a little bit of independent research on this front there seems to only be a few libraries that are not dead that meet your requirements. Noble seems to be one. Here is an article talking about it: https://www.nikgraf.com/blog/choosing-a-cryptography-library-in-javascript-noble-vs-libsodium-js

With a level 10 severity CVE on the current crypto-js library this is an issue that should be addressed quickly and not left to fester.

[bjdawson]

By the way, it looks like there is a newer version (v4.2.0) of crypto-js than what you are using (v4.1.1) that does not have any CVEs listed. Bumping the version to the latest version would at least get you to a better state while you investigate alternatives.

[pacroy]

Any progress on this? Can we apply a quick fix by bumping crypto-js to the new v4.2.0 ? and later evaluate alternative library like noble as per @bjdawson suggested?

[helloanoop]

Thank you @bjdawson for the recommendations.
Noble seems like a great fit.

We have allocated bandwidth first half of September to integrate with Noble and remove crypto-js dependency in Safe Mode.
This is expected to go out in Sep last week.

[PramodKumarYadav]

Thanks @helloanoop 🙏. Eagerly looking forward to it 🙌😊

[bjdawson]

@helloanoop Awesome news. Thanks for the update.

[helloanoop]

We were able to make crypto-js work in Safe Mode with the latest version 4.2.0 (see pr)

This will go out in our upcoming release v2.12.0 set to go on 23rd Sep 2025

[PramodKumarYadav]

Thanks @helloanoop 🙌 :)

[bjdawson]

Great news! @helloanoop Are you still planning to move to something else as well?

[helloanoop]

@bjdawson Yes, l've created a ticket #5569 to track supporting noble - given that crypto-js is no longer being maintained.