crypto: handle invalid prepareAsymmetricKey JWK inputs

Fixes #44471

Author: panva

lib/internal/crypto/keygen.js

@@ -31,7 +31,6 @@ const {
   SecretKeyObject,
   parsePublicKeyEncoding,
   parsePrivateKeyEncoding,
-  isJwk
 } = require('internal/crypto/keys');
 
 const {
@@ -66,6 +65,10 @@ const { isArrayBufferView } = require('internal/util/types');
 
 const { getOptionValue } = require('internal/options');
 
+function isJwk(obj) {
+  return obj != null && obj.kty !== undefined;
+}
+
 function wrapKey(key, ctor) {
   if (typeof key === 'string' ||
       isArrayBufferView(key) ||

lib/internal/crypto/keys.js

@@ -525,14 +525,19 @@ function prepareAsymmetricKey(key, ctx) {
     return { format: kKeyFormatPEM, data: getArrayBufferOrView(key, 'key') };
   } else if (typeof key === 'object') {
     const { key: data, encoding, format } = key;
+
     // The 'key' property can be a KeyObject as well to allow specifying
     // additional options such as padding along with the key.
     if (isKeyObject(data))
       return { data: getKeyObjectHandle(data, ctx) };
     else if (isCryptoKey(data))
       return { data: getKeyObjectHandle(data[kKeyObject], ctx) };
-    else if (isJwk(data) && format === 'jwk')
+    else if (format === 'jwk') {
+      validateObject(data, 'key.key');
+      validateString(data.kty, 'key.key.kty');
       return { data: getKeyObjectHandleFromJwk(data, ctx), format: 'jwk' };
+    }
+
     // Either PEM or DER using PKCS#1 or SPKI.
     if (!isStringOrBuffer(data)) {
       throw new ERR_INVALID_ARG_TYPE(
@@ -720,10 +725,6 @@ function isCryptoKey(obj) {
   return obj != null && obj[kKeyObject] !== undefined;
 }
 
-function isJwk(obj) {
-  return obj != null && obj.kty !== undefined;
-}
-
 module.exports = {
   // Public API.
   createSecretKey,
@@ -745,5 +746,4 @@ module.exports = {
   PrivateKeyObject,
   isKeyObject,
   isCryptoKey,
-  isJwk,
 };

test/parallel/test-crypto-key-objects.js

@@ -868,3 +868,23 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
   assert(!first.equals(third));
   assert(!third.equals(first));
 }
+
+{
+  // This should not cause a crash: https://github.com/nodejs/node/issues/44471
+  for (const key of ['', 'foo', null, undefined, true, Boolean]) {
+    assert.throws(() => {
+      createPublicKey({ key, format: 'jwk' });
+    }, { code: 'ERR_INVALID_ARG_TYPE', message: /The "key\.key" property must be of type object/ });
+    assert.throws(() => {
+      createPrivateKey({ key, format: 'jwk' });
+    }, { code: 'ERR_INVALID_ARG_TYPE', message: /The "key\.key" property must be of type object/ });
+  }
+  for (const kty of [null, undefined, true, Boolean]) {
+    assert.throws(() => {
+      createPublicKey({ key: { kty }, format: 'jwk' });
+    }, { code: 'ERR_INVALID_ARG_TYPE', message: /The "key\.key\.kty" property must be of type string/ });
+    assert.throws(() => {
+      createPrivateKey({ key: { kty }, format: 'jwk' });
+    }, { code: 'ERR_INVALID_ARG_TYPE', message: /The "key\.key\.kty" property must be of type string/ });
+  }
+}

test/parallel/test-crypto-sign-verify.js

@@ -756,3 +756,21 @@ assert.throws(
     message: /digest too big for rsa key/
   });
 }
+
+{
+  // This should not cause a crash: https://github.com/nodejs/node/issues/44471
+  for (const key of ['', 'foo', null, undefined, true, Boolean]) {
+    assert.throws(() => {
+      crypto.verify('sha256', 'foo', { key, format: 'jwk' }, Buffer.alloc(0));
+    }, { code: 'ERR_INVALID_ARG_TYPE', message: /The "key\.key" property must be of type object/ });
+    assert.throws(() => {
+      crypto.createVerify('sha256').verify({ key, format: 'jwk' }, Buffer.alloc(0));
+    }, { code: 'ERR_INVALID_ARG_TYPE', message: /The "key\.key" property must be of type object/ });
+    assert.throws(() => {
+      crypto.sign('sha256', 'foo', { key, format: 'jwk' });
+    }, { code: 'ERR_INVALID_ARG_TYPE', message: /The "key\.key" property must be of type object/ });
+    assert.throws(() => {
+      crypto.createSign('sha256').sign({ key, format: 'jwk' });
+    }, { code: 'ERR_INVALID_ARG_TYPE', message: /The "key\.key" property must be of type object/ });
+  }
+}