Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
if (password.id) {
if (!/^\w+$/.test(password.id)) {
throw new Boom.Boom('Invalid password id');
}
passwordId = password.id;
}
// Encrypt object string
const { encrypted, key } = await exports.encrypt(password.encryption, options.encryption, objectString);
// Base64url the encrypted value
const encryptedB64 = B64.base64urlEncode(encrypted);
const iv = B64.base64urlEncode(key.iv);
const expiration = (options.ttl ? now + options.ttl : '');
const macBaseString = exports.macPrefix + '*' + passwordId + '*' + key.salt + '*' + iv + '*' + encryptedB64 + '*' + expiration;
// Mac the combined values
const mac = await exports.hmacWithPassword(password.integrity, options.integrity, macBaseString);
// Put it all together
// prefix*[password-id]*encryption-salt*encryption-iv*encrypted*[expiration]*hmac-salt*hmac
// Allowed URI query name/value characters: *-. \d \w
const sealed = macBaseString + '*' + mac.salt + '*' + mac.digest;
return sealed;
};
password = internals.normalizePassword(password);
if (password.id) {
if (!/^\w+$/.test(password.id)) {
throw new Boom.Boom('Invalid password id');
}
passwordId = password.id;
}
// Encrypt object string
const { encrypted, key } = await exports.encrypt(password.encryption, options.encryption, objectString);
// Base64url the encrypted value
const encryptedB64 = B64.base64urlEncode(encrypted);
const iv = B64.base64urlEncode(key.iv);
const expiration = (options.ttl ? now + options.ttl : '');
const macBaseString = exports.macPrefix + '*' + passwordId + '*' + key.salt + '*' + iv + '*' + encryptedB64 + '*' + expiration;
// Mac the combined values
const mac = await exports.hmacWithPassword(password.integrity, options.integrity, macBaseString);
// Put it all together
// prefix*[password-id]*encryption-salt*encryption-iv*encrypted*[expiration]*hmac-salt*hmac
// Allowed URI query name/value characters: *-. \d \w
const sealed = macBaseString + '*' + mac.salt + '*' + mac.digest;
return sealed;
};
const exp = Math.floor(now / 1000) + options.ttlSec;
const mac = Crypto.calculateMac('bewit', credentials, {
ts: exp,
nonce: '',
method: 'GET',
resource: uri.pathname + (uri.search || ''), // Maintain trailing '?'
host: uri.hostname,
port: uri.port || (uri.protocol === 'http:' ? 80 : 443),
ext
});
// Construct bewit: id\exp\mac\ext
const bewit = credentials.id + '\\' + exp + '\\' + mac + '\\' + ext;
return B64.base64urlEncode(bewit);
};
it('returns an error when decrypted object is invalid', async () => {
const badJson = '{asdasd';
const { encrypted, key } = await Iron.encrypt(password, Iron.defaults.encryption, badJson);
const encryptedB64 = B64.base64urlEncode(encrypted);
const iv = B64.base64urlEncode(key.iv);
const macBaseString = Iron.macPrefix + '**' + key.salt + '*' + iv + '*' + encryptedB64 + '*';
const mac = await Iron.hmacWithPassword(password, Iron.defaults.integrity, macBaseString);
const ticket = macBaseString + '*' + mac.salt + '*' + mac.digest;
const err = await expect(Iron.unseal(ticket, password, Iron.defaults)).to.reject(/Failed parsing sealed object JSON: Unexpected token a/);
expect(err.isBoom).to.be.true();
});
it('returns an error when decrypted object is invalid', async () => {
const badJson = '{asdasd';
const { encrypted, key } = await Iron.encrypt(password, Iron.defaults.encryption, badJson);
const encryptedB64 = B64.base64urlEncode(encrypted);
const iv = B64.base64urlEncode(key.iv);
const macBaseString = Iron.macPrefix + '**' + key.salt + '*' + iv + '*' + encryptedB64 + '*';
const mac = await Iron.hmacWithPassword(password, Iron.defaults.integrity, macBaseString);
const ticket = macBaseString + '*' + mac.salt + '*' + mac.digest;
const err = await expect(Iron.unseal(ticket, password, Iron.defaults)).to.reject(/Failed parsing sealed object JSON: Unexpected token a/);
expect(err.isBoom).to.be.true();
});
const exp = Math.floor(Hawk.utils.now() / 1000) + 60;
const ext = 'some-app-data';
const mac = Hawk.crypto.calculateMac('bewit', credentials, {
ts: exp,
nonce: '',
method: req.method,
resource: req.url,
host: req.host,
port: req.port,
ext
});
const bewit = credentials.id + '\\' + exp + '\\' + mac + '\\' + ext;
req.url += '&bewit=' + B64.base64urlEncode(bewit);
await expect(Hawk.uri.authenticate(req, credentialsFunc)).to.reject('Invalid method');
});