fix: properly restrict EC curves in generate(Sync)

panva · Mar 28, 2019 · 764b863 · 764b863
1 parent 3854431
commit 764b863
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 6 deletions.
diff --git a/lib/help/key_utils.js b/lib/help/key_utils.js
@@ -2,12 +2,7 @@ const base64url = require('./base64url')
 const errors = require('../errors')
 const asn1 = require('./asn1')
 
-const EC_CURVES = new Set([
- 'P-256',
- 'P-256K',
- 'P-384',
- 'P-521'
-])
+const EC_CURVES = new Set(['P-256', 'P-256K', 'P-384', 'P-521'])
 
 const oidHexToCurve = new Map([
  ['06082a8648ce3d030107', 'P-256'],

diff --git a/lib/jwk/key/ec.js b/lib/jwk/key/ec.js
@@ -3,6 +3,7 @@ const { promisify } = require('util')
 
 const { THUMBPRINT_MATERIAL, PUBLIC_MEMBERS, PRIVATE_MEMBERS, JWK_MEMBERS } = require('../../help/symbols')
 const errors = require('../../errors')
+const EC_CURVES = new Set(['P-256', 'P-256K', 'P-384', 'P-521'])
 
 const Key = require('./base')
 
@@ -99,6 +100,10 @@ class ECKey extends Key {
  }
 
  static async generate (crv = 'P-256', privat = true) {
+ if (!EC_CURVES.has(crv)) {
+ throw new errors.JOSENotSupported(`unsupported EC key curve: ${crv}`)
+ }
+
  if (crv === 'P-256K') {
  crv = 'secp256k1'
  }
@@ -108,6 +113,10 @@ class ECKey extends Key {
  }
 
  static generateSync (crv = 'P-256', privat = true) {
+ if (!EC_CURVES.has(crv)) {
+ throw new errors.JOSENotSupported(`unsupported EC key curve: ${crv}`)
+ }
+
  if (crv === 'P-256K') {
  crv = 'secp256k1'
  }

diff --git a/test/jwk/generate.test.js b/test/jwk/generate.test.js
@@ -126,6 +126,18 @@ test('fails to generate unsupported kty', async t => {
  }, { instanceOf: errors.JOSENotSupported, message: 'unsupported key type: OKP' })
 })
 
+test('fails to generateSync unsupported EC crv', t => {
+ t.throws(() => {
+ generateSync('EC', 'foo')
+ }, { instanceOf: errors.JOSENotSupported, message: 'unsupported EC key curve: foo' })
+})
+
+test('fails to generate unsupported EC crv', async t => {
+ await t.throwsAsync(() => {
+ return generate('EC', 'foo')
+ }, { instanceOf: errors.JOSENotSupported, message: 'unsupported EC key curve: foo' })
+})
+
 test('fails to generateSync RSA with invalid bit lengths', t => {
  t.throws(() => {
  generateSync('RSA', 2048 + 1)