fix: decrypting empty ciphertext compact JWEs (#374)

panva · Mar 4, 2022 · 95fe597 · 95fe597
1 parent 8d016fd
commit 95fe597
Show file tree

Hide file tree

Showing 4 changed files with 36 additions and 2 deletions.
diff --git a/src/jwe/compact/decrypt.ts b/src/jwe/compact/decrypt.ts
@@ -77,7 +77,7 @@ export async function compactDecrypt(
 
  const decrypted = await flattenedDecrypt(
  {
- ciphertext: <string>(ciphertext || undefined),
+ ciphertext,
  iv: <string>(iv || undefined),
  protected: protectedHeader || undefined,
  tag: <string>(tag || undefined),

diff --git a/test/jwe/compact.decrypt.test.mjs b/test/jwe/compact.decrypt.test.mjs
@@ -1,7 +1,7 @@
 import test from 'ava'
 
 const root = !('WEBCRYPTO' in process.env) ? '#dist' : '#dist/webcrypto'
-const { compactDecrypt } = await import(root)
+const { CompactEncrypt, compactDecrypt } = await import(root)
 
 test('JWE format validation', async (t) => {
  await t.throwsAsync(compactDecrypt(null, new Uint8Array(0)), {
@@ -13,3 +13,14 @@ test('JWE format validation', async (t) => {
  code: 'ERR_JWE_INVALID',
  })
 })
+
+test('decrypt empty data', async (t) => {
+ const jwe = await new CompactEncrypt(new Uint8Array(0))
+ .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
+ .encrypt(new Uint8Array(16))
+
+ t.is(jwe.split('.')[3], '')
+
+ const { plaintext } = await compactDecrypt(jwe, new Uint8Array(16))
+ t.is(plaintext.byteLength, 0)
+})
diff --git a/test/jwe/flattened.decrypt.test.mjs b/test/jwe/flattened.decrypt.test.mjs
@@ -217,3 +217,14 @@ test('AES CBC + HMAC', async (t) => {
  })
  }
 })
+
+test('decrypt empty data', async (t) => {
+ const jwe = await new FlattenedEncrypt(new Uint8Array(0))
+ .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
+ .encrypt(new Uint8Array(16))
+
+ t.is(jwe.ciphertext, '')
+
+ const { plaintext } = await flattenedDecrypt(jwe, new Uint8Array(16))
+ t.is(plaintext.byteLength, 0)
+})
diff --git a/test/jwe/general.test.mjs b/test/jwe/general.test.mjs
@@ -170,3 +170,15 @@ test('General JWE format validation', async (t) => {
  await t.notThrowsAsync(generalDecrypt(jwe, t.context.secret))
  }
 })
+
+test('decrypt empty data', async (t) => {
+ const jwe = await new GeneralEncrypt(new Uint8Array(0))
+ .setProtectedHeader({ alg: 'dir', enc: 'A128GCM' })
+ .addRecipient(new Uint8Array(16))
+ .encrypt()
+
+ t.is(jwe.ciphertext, '')
+
+ const { plaintext } = await generalDecrypt(jwe, new Uint8Array(16))
+ t.is(plaintext.byteLength, 0)
+})