test: add WebCrypto Promise.prototype.then pollution regression tests

PR-URL: #62226
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jordan Harband <ljharb@gmail.com>
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Zeyu "Alex" Yang <himself65@outlook.com>

Author: panva

test/parallel/test-webcrypto-promise-prototype-pollution.mjs

@@ -0,0 +1,95 @@
+import*ascommonfrom'../common/index.mjs';
+
+if(!common.hasCrypto)common.skip('missing crypto');
+
+// WebCrypto subtle methods must not leak intermediate values
+// through Promise.prototype.then pollution.
+// Regression test for https://github.com/nodejs/node/pull/61492
+// and https://github.com/nodejs/node/issues/59699.
+
+import{hasOpenSSL}from'../common/crypto.js';
+
+const{ subtle }=globalThis.crypto;
+
+Promise.prototype.then=common.mustNotCall('Promise.prototype.then');
+
+awaitsubtle.digest('SHA-256',newUint8Array([1,2,3]));
+
+awaitsubtle.generateKey({name: 'AES-CBC',length: 256},true,['encrypt','decrypt']);
+
+awaitsubtle.generateKey({name: 'ECDSA',namedCurve: 'P-256'},true,['sign','verify']);
+
+constrawKey=globalThis.crypto.getRandomValues(newUint8Array(32));
+
+constimportedKey=awaitsubtle.importKey(
+'raw',rawKey,{name: 'AES-CBC',length: 256},false,['encrypt','decrypt']);
+
+constexportableKey=awaitsubtle.importKey(
+'raw',rawKey,{name: 'AES-CBC',length: 256},true,['encrypt','decrypt']);
+
+awaitsubtle.exportKey('raw',exportableKey);
+
+constiv=globalThis.crypto.getRandomValues(newUint8Array(16));
+constplaintext=newTextEncoder().encode('Hello, world!');
+
+constciphertext=awaitsubtle.encrypt({name: 'AES-CBC', iv },importedKey,plaintext);
+
+awaitsubtle.decrypt({name: 'AES-CBC', iv },importedKey,ciphertext);
+
+constsigningKey=awaitsubtle.generateKey(
+{name: 'HMAC',hash: 'SHA-256'},false,['sign','verify']);
+
+constdata=newTextEncoder().encode('test data');
+
+constsignature=awaitsubtle.sign('HMAC',signingKey,data);
+
+awaitsubtle.verify('HMAC',signingKey,signature,data);
+
+constpbkdf2Key=awaitsubtle.importKey(
+'raw',rawKey,'PBKDF2',false,['deriveBits','deriveKey']);
+
+awaitsubtle.deriveBits(
+{name: 'PBKDF2',salt: rawKey,iterations: 1000,hash: 'SHA-256'},
+pbkdf2Key,256);
+
+awaitsubtle.deriveKey(
+{name: 'PBKDF2',salt: rawKey,iterations: 1000,hash: 'SHA-256'},
+pbkdf2Key,
+{name: 'AES-CBC',length: 256},
+true,
+['encrypt','decrypt']);
+
+constwrappingKey=awaitsubtle.generateKey(
+{name: 'AES-KW',length: 256},true,['wrapKey','unwrapKey']);
+
+constkeyToWrap=awaitsubtle.generateKey(
+{name: 'AES-CBC',length: 256},true,['encrypt','decrypt']);
+
+constwrapped=awaitsubtle.wrapKey('raw',keyToWrap,wrappingKey,'AES-KW');
+
+awaitsubtle.unwrapKey(
+'raw',wrapped,wrappingKey,'AES-KW',
+{name: 'AES-CBC',length: 256},true,['encrypt','decrypt']);
+
+const{ privateKey }=awaitsubtle.generateKey(
+{name: 'ECDSA',namedCurve: 'P-256'},true,['sign','verify']);
+
+awaitsubtle.getPublicKey(privateKey,['verify']);
+
+if(hasOpenSSL(3,5)){
+constkemPair=awaitsubtle.generateKey(
+{name: 'ML-KEM-768'},false,
+['encapsulateKey','encapsulateBits','decapsulateKey','decapsulateBits']);
+
+const{ciphertext: ct1}=awaitsubtle.encapsulateKey(
+{name: 'ML-KEM-768'},kemPair.publicKey,'HKDF',false,['deriveBits']);
+
+awaitsubtle.decapsulateKey(
+{name: 'ML-KEM-768'},kemPair.privateKey,ct1,'HKDF',false,['deriveBits']);
+
+const{ciphertext: ct2}=awaitsubtle.encapsulateBits(
+{name: 'ML-KEM-768'},kemPair.publicKey);
+
+awaitsubtle.decapsulateBits(
+{name: 'ML-KEM-768'},kemPair.privateKey,ct2);
+}