Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (request.method !== 'GET' &&
request.method !== 'HEAD') {
throw Utils.unauthorized('Invalid method');
}
// No other authentication
if (request.authorization) {
throw Boom.badRequest('Multiple authentications');
}
// Parse bewit
try {
var bewitString = B64.base64urlDecode(resource[3]);
}
catch (err) {
throw Boom.badRequest('Invalid bewit encoding');
}
// Bewit format: id\exp\mac\ext ('\' is used because it is a reserved header attribute character)
const bewitParts = bewitString.split('\\');
if (bewitParts.length !== 4) {
throw Boom.badRequest('Invalid bewit structure');
}
const bewit = {
id: bewitParts[0],
exp: parseInt(bewitParts[1], 10),
mac: bewitParts[2],
password = internals.normalizePassword(password);
// Check hmac
const macOptions = Hoek.clone(options.integrity);
macOptions.salt = hmacSalt;
const mac = await exports.hmacWithPassword(password.integrity, macOptions, macBaseString);
if (!Cryptiles.fixedTimeComparison(mac.digest, hmac)) {
throw new Boom.Boom('Bad hmac value');
}
// Decrypt
try {
var encrypted = B64.base64urlDecode(encryptedB64, 'buffer');
}
catch (err) {
throw Boom.boomify(err);
}
const decryptOptions = Hoek.clone(options.encryption);
decryptOptions.salt = encryptionSalt;
try {
decryptOptions.iv = B64.base64urlDecode(encryptionIv, 'buffer');
}
catch (err) {
throw Boom.boomify(err);
}
const decrypted = await exports.decrypt(password.encryption, decryptOptions, encrypted);
}
// Decrypt
try {
var encrypted = B64.base64urlDecode(encryptedB64, 'buffer');
}
catch (err) {
throw Boom.boomify(err);
}
const decryptOptions = Hoek.clone(options.encryption);
decryptOptions.salt = encryptionSalt;
try {
decryptOptions.iv = B64.base64urlDecode(encryptionIv, 'buffer');
}
catch (err) {
throw Boom.boomify(err);
}
const decrypted = await exports.decrypt(password.encryption, decryptOptions, encrypted);
// Parse JSON
try {
return Bourne.parse(decrypted);
}
catch (err) {
throw new Boom.Boom('Failed parsing sealed object JSON: ' + err.message);
}
};