crypto: harden WebCrypto against prototype pollution

Avoid re-wrapping native WebCrypto promises with PromiseResolve(),
since resolving a promise can read its user-mutated constructor.
Add a helper for chaining internal WebCrypto job promises without
consulting Promise species state, and use it for intermediate job
results.
Also align JWK wrapping and unwrapping with the spec's fresh-global
JSON handling by detaching internal JWK values from user prototypes.
Use the internal UTF-8 encoder/decoder bindings instead of shared
TextEncoder/TextDecoder prototype methods.
Expand the WebCrypto prototype pollution regression test to cover
SubtleCrypto methods, export formats, zero-length KDF results, JWK
toJSON/kty pollution, and encoder/decoder prototype poisoning.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #63363
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: René <contact.9a5d6388@renegade334.me.uk>

Author: panva

lib/internal/crypto/diffiehellman.js

@@ -5,7 +5,6 @@ const {
  FunctionPrototypeCall,
  MathCeil,
  ObjectDefineProperty,
- PromisePrototypeThen,
  SafeSet,
  TypedArrayPrototypeGetBuffer,
  Uint8Array,
@@ -66,6 +65,7 @@ const {
 const{
  getArrayBufferOrView,
  jobPromise,
+ jobPromiseThen,
  toBuf,
  kHandle,
 }=require('internal/crypto/util');
@@ -409,7 +409,7 @@ function ecdhDeriveBits(algorithm, baseKey, length) {
 if(length===null)
 returnbits;
 
-returnPromisePrototypeThen(bits,(bits)=>{
+returnjobPromiseThen(bits,(bits)=>{
 // If the length is not a multiple of 8 the nearest ceiled
 // multiple of 8 is sliced.
 constsliceLength=MathCeil(length/8);

lib/internal/crypto/util.js

@@ -14,7 +14,9 @@ const {
  ObjectEntries,
  ObjectKeys,
  ObjectPrototypeHasOwnProperty,
+ PromisePrototypeThen,
  PromiseReject,
+ PromiseWithResolvers,
  SafeMap,
  SafeSet,
  StringPrototypeToUpperCase,
@@ -77,6 +79,7 @@ const {
  emitExperimentalWarning,
  filterDuplicateStrings,
  lazyDOMException,
+ setOwnProperty,
 }=require('internal/util');
 
 const{
@@ -90,6 +93,7 @@ const {
  isDataView,
  isArrayBufferView,
  isAnyArrayBuffer,
+ isPromise,
 }=require('internal/util/types');
 
 constkHandle=Symbol('kHandle');
@@ -677,6 +681,69 @@ function jobPromise(getJob) {
 }
 }
 
+// Temporarily shadow inherited then accessors on WebCrypto result objects.
+// Promise resolution reads "then" synchronously for thenable assimilation.
+// Returning an own undefined data property keeps that lookup from reaching
+// user-mutated prototypes.
+functionprepareWebCryptoResult(value){
+if((value===null||typeofvalue!=='object')&&
+typeofvalue!=='function'){
+returnfalse;
+}
+if(isPromise(value)||ObjectPrototypeHasOwnProperty(value,'then'))
+returnfalse;
+setOwnProperty(value,'then',undefined);
+returntrue;
+}
+
+// Remove the temporary then property installed by prepareWebCryptoResult().
+functioncleanupWebCryptoResult(value){
+deletevalue.then;
+}
+
+// Resolve a WebCrypto promise while inherited then accessors are shadowed.
+functionresolveWebCryptoResult(resolve,value){
+constshouldCleanupResult=prepareWebCryptoResult(value);
+try{
+resolve(value);
+}finally{
+if(shouldCleanupResult)
+cleanupWebCryptoResult(value);
+}
+}
+
+// Run a WebCrypto promise reaction and settle the outer promise.
+functionsettleJobPromise(handler,resolve,reject,value,isRejected){
+try{
+if(typeofhandler==='function'){
+resolveWebCryptoResult(resolve,handler(value));
+}elseif(isRejected){
+reject(value);
+}else{
+resolveWebCryptoResult(resolve,value);
+}
+}catch(err){
+reject(err);
+}
+}
+
+// Promise.prototype.then gets promise.constructor to determine the result
+// promise's species. These promises are internal WebCrypto intermediates, so
+// make that lookup stay on the promise itself instead of user-mutated state.
+functionjobPromiseThen(promise,onFulfilled,onRejected){
+const{
+promise: resultPromise,
+ resolve,
+ reject,
+}=PromiseWithResolvers();
+setOwnProperty(promise,'constructor',undefined);
+PromisePrototypeThen(
+promise,
+(value)=>settleJobPromise(onFulfilled,resolve,reject,value,false),
+(value)=>settleJobPromise(onRejected,resolve,reject,value,true));
+returnresultPromise;
+}
+
 // In WebCrypto, the publicExponent option in RSA is represented as a
 // WebIDL "BigInteger"... that is, a Uint8Array that allows an arbitrary
 // number of leading zero bits. Our conventional APIs for reading
@@ -899,6 +966,9 @@ module.exports = {
  validateByteSource,
  validateKeyOps,
  jobPromise,
+ jobPromiseThen,
+ cleanupWebCryptoResult,
+ prepareWebCryptoResult,
  validateMaxBufferLength,
  bigIntArrayToUnsignedBigInt,
  bigIntArrayToUnsignedInt,