crypto,lib: read WebCrypto inputs through primordials by panva · Pull Request #65115 · nodejs/node

panva · 2026-08-07T18:26:24Z

A pass over the Web Crypto implementation from a primordials perspective, continuing where #63363 left off. That one covered the promise/thenable side, this covers input validation and normalization.

Per our threat model, prototype pollution requiring control over user input is not a vulnerability so this is hardening and spec-fidelity work rather than a security fix.

Three things covered:

internal tables null prototype
BufferSource.{byteLength,buffer,byteOffset}
new SafeSet(usages) usages %Array.prototype%` iterator

The obvious (__proto__: null) fix regresses badly: V8 creates __proto__: null object literals in dictionary mode and constant-folds absent-property loads through a stable %Object.prototype% chain. Applied naively that cost -88% on webidl-dict-null and -24% on normalizeAlgorithm-string. Instead, tables are detached with ObjectSetPrototypeOf() after construction, options and descriptors spell out every key they read, and dictionaries needing no missing-member handling skip those reads.

benchmark/misc/webcrypto-webidl, 25 runs, medians:

benchmark	delta
`normalizeAlgorithm-string`	+2.78%
`normalizeAlgorithm-dict`	+0.57%
`webidl-dict`	-0.97%
`webidl-dict-null`	+0.59%
`webidl-dict-enforce-range`	-1.81%
`webidl-dict-ensure-sha`	+1.50%

All within noise.

Member descriptors are plain object literals that spell out only the members they need, so createDictionaryConverter() reading the optional validator, defaultValue and required members off them resolves through %Object.prototype%. Copy each descriptor once at construction time with every key present. They keep an ordinary prototype because a null-prototype object literal lands in V8 dictionary mode, and dictionaries with no defaults and no required members now skip steps 4.1.5 and 4.1.6. Signed-off-by: Filip Skokan <panva.ip@gmail.com>

BufferSource conversion hands over the caller's own object uncopied, so byteLength, byteOffset, buffer and length reads on it run user-replaceable prototype accessors. Internal lookup tables are indexed with computed keys, so a polluted %Object.prototype% key answers a miss. The %Set% constructor iterates its argument through the user-mutable %Array.prototype% iterator. The algorithm registry and the hash name tables are detached from %Object.prototype% after construction rather than declared `__proto__: null`, which V8 places in dictionary mode. Signed-off-by: Filip Skokan <panva.ip@gmail.com>

nodejs-github-bot · 2026-08-07T18:26:30Z

Review requested:

@nodejs/crypto

codecov · 2026-08-07T20:57:52Z

Codecov Report

❌ Patch coverage is 98.96907% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.30%. Comparing base (6c862f4) to head (e0ce135).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/internal/crypto/util.js	98.55%	1 Missing ⚠️
lib/internal/crypto/webidl.js	96.29%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## main #65115 +/- ##
========================================
Coverage 90.29% 90.30% ========================================
Files 759 759 Lines 248295 248404 +109 Branches 46861 46872 +11 ========================================
+ Hits 224205 224328 +123 + Misses 15517 15509 -8 + Partials 8573 8567 -6

Files with missing lines	Coverage Δ
lib/internal/crypto/aes.js	`93.75% <100.00%> (+0.02%)`	⬆️
lib/internal/crypto/cfrg.js	`95.89% <100.00%> (ø)`
lib/internal/crypto/diffiehellman.js	`97.73% <100.00%> (+<0.01%)`	⬆️
lib/internal/crypto/ec.js	`96.89% <100.00%> (+0.01%)`	⬆️
lib/internal/crypto/hash.js	`98.14% <100.00%> (+<0.01%)`	⬆️
lib/internal/crypto/hashnames.js	`100.00% <100.00%> (ø)`
lib/internal/crypto/keys.js	`98.04% <100.00%> (ø)`
lib/internal/crypto/ml_dsa.js	`97.37% <100.00%> (+0.01%)`	⬆️
lib/internal/crypto/ml_kem.js	`95.33% <100.00%> (+0.01%)`	⬆️
lib/internal/crypto/rsa.js	`94.89% <100.00%> (ø)`
... and 5 more

... and 30 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-08-07T22:25:59Z

CI: https://ci.nodejs.org/job/node-test-pull-request/75630/

nodejs-github-bot · 2026-08-09T19:10:31Z

Landed in abbf086...e04663a

Member descriptors are plain object literals that spell out only the members they need, so createDictionaryConverter() reading the optional validator, defaultValue and required members off them resolves through %Object.prototype%. Copy each descriptor once at construction time with every key present. They keep an ordinary prototype because a null-prototype object literal lands in V8 dictionary mode, and dictionaries with no defaults and no required members now skip steps 4.1.5 and 4.1.6. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65115 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

BufferSource conversion hands over the caller's own object uncopied, so byteLength, byteOffset, buffer and length reads on it run user-replaceable prototype accessors. Internal lookup tables are indexed with computed keys, so a polluted %Object.prototype% key answers a miss. The %Set% constructor iterates its argument through the user-mutable %Array.prototype% iterator. The algorithm registry and the hash name tables are detached from %Object.prototype% after construction rather than declared `__proto__: null`, which V8 places in dictionary mode. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65115 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

Member descriptors are plain object literals that spell out only the members they need, so createDictionaryConverter() reading the optional validator, defaultValue and required members off them resolves through %Object.prototype%. Copy each descriptor once at construction time with every key present. They keep an ordinary prototype because a null-prototype object literal lands in V8 dictionary mode, and dictionaries with no defaults and no required members now skip steps 4.1.5 and 4.1.6. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65115 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

BufferSource conversion hands over the caller's own object uncopied, so byteLength, byteOffset, buffer and length reads on it run user-replaceable prototype accessors. Internal lookup tables are indexed with computed keys, so a polluted %Object.prototype% key answers a miss. The %Set% constructor iterates its argument through the user-mutable %Array.prototype% iterator. The algorithm registry and the hash name tables are detached from %Object.prototype% after construction rather than declared `__proto__: null`, which V8 places in dictionary mode. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65115 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

Member descriptors are plain object literals that spell out only the members they need, so createDictionaryConverter() reading the optional validator, defaultValue and required members off them resolves through %Object.prototype%. Copy each descriptor once at construction time with every key present. They keep an ordinary prototype because a null-prototype object literal lands in V8 dictionary mode, and dictionaries with no defaults and no required members now skip steps 4.1.5 and 4.1.6. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65115 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

BufferSource conversion hands over the caller's own object uncopied, so byteLength, byteOffset, buffer and length reads on it run user-replaceable prototype accessors. Internal lookup tables are indexed with computed keys, so a polluted %Object.prototype% key answers a miss. The %Set% constructor iterates its argument through the user-mutable %Array.prototype% iterator. The algorithm registry and the hash name tables are detached from %Object.prototype% after construction rather than declared `__proto__: null`, which V8 places in dictionary mode. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65115 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

Member descriptors are plain object literals that spell out only the members they need, so createDictionaryConverter() reading the optional validator, defaultValue and required members off them resolves through %Object.prototype%. Copy each descriptor once at construction time with every key present. They keep an ordinary prototype because a null-prototype object literal lands in V8 dictionary mode, and dictionaries with no defaults and no required members now skip steps 4.1.5 and 4.1.6. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65115 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

BufferSource conversion hands over the caller's own object uncopied, so byteLength, byteOffset, buffer and length reads on it run user-replaceable prototype accessors. Internal lookup tables are indexed with computed keys, so a polluted %Object.prototype% key answers a miss. The %Set% constructor iterates its argument through the user-mutable %Array.prototype% iterator. The algorithm registry and the hash name tables are detached from %Object.prototype% after construction rather than declared `__proto__: null`, which V8 places in dictionary mode. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #65115 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Aviv Keller <me@aviv.sh>

panva · 2026-08-07T18:26:24Z

A pass over the Web Crypto implementation from a primordials perspective, continuing where #63363 left off. That one covered the promise/thenable side, this covers input validation and normalization.

Per our threat model, prototype pollution requiring control over user input is not a vulnerability so this is hardening and spec-fidelity work rather than a security fix.

Three things covered:

internal tables null prototype
BufferSource.{byteLength,buffer,byteOffset}
new SafeSet(usages) usages %Array.prototype%` iterator

The obvious (__proto__: null) fix regresses badly: V8 creates __proto__: null object literals in dictionary mode and constant-folds absent-property loads through a stable %Object.prototype% chain. Applied naively that cost -88% on webidl-dict-null and -24% on normalizeAlgorithm-string. Instead, tables are detached with ObjectSetPrototypeOf() after construction, options and descriptors spell out every key they read, and dictionaries needing no missing-member handling skip those reads.

benchmark/misc/webcrypto-webidl, 25 runs, medians:

benchmark	delta
`normalizeAlgorithm-string`	+2.78%
`normalizeAlgorithm-dict`	+0.57%
`webidl-dict`	-0.97%
`webidl-dict-null`	+0.59%
`webidl-dict-enforce-range`	-1.81%
`webidl-dict-ensure-sha`	+1.50%

All within noise.

Member descriptors are plain object literals that spell out only the members they need, so createDictionaryConverter() reading the optional validator, defaultValue and required members off them resolves through %Object.prototype%. Copy each descriptor once at construction time with every key present. They keep an ordinary prototype because a null-prototype object literal lands in V8 dictionary mode, and dictionaries with no defaults and no required members now skip steps 4.1.5 and 4.1.6. Signed-off-by: Filip Skokan <panva.ip@gmail.com>

BufferSource conversion hands over the caller's own object uncopied, so byteLength, byteOffset, buffer and length reads on it run user-replaceable prototype accessors. Internal lookup tables are indexed with computed keys, so a polluted %Object.prototype% key answers a miss. The %Set% constructor iterates its argument through the user-mutable %Array.prototype% iterator. The algorithm registry and the hash name tables are detached from %Object.prototype% after construction rather than declared `__proto__: null`, which V8 places in dictionary mode. Signed-off-by: Filip Skokan <panva.ip@gmail.com>

nodejs-github-bot · 2026-08-07T18:26:30Z

Review requested:

@nodejs/crypto

codecov · 2026-08-07T20:57:52Z

Codecov Report

❌ Patch coverage is 98.96907% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.30%. Comparing base (6c862f4) to head (e0ce135).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
lib/internal/crypto/util.js	98.55%	1 Missing ⚠️
lib/internal/crypto/webidl.js	96.29%	1 Missing ⚠️

Additional details and impacted files

@@ Coverage Diff @@## main #65115 +/- ##
========================================
Coverage 90.29% 90.30% ========================================
Files 759 759 Lines 248295 248404 +109 Branches 46861 46872 +11 ========================================
+ Hits 224205 224328 +123 + Misses 15517 15509 -8 + Partials 8573 8567 -6

Files with missing lines	Coverage Δ
lib/internal/crypto/aes.js	`93.75% <100.00%> (+0.02%)`	⬆️
lib/internal/crypto/cfrg.js	`95.89% <100.00%> (ø)`
lib/internal/crypto/diffiehellman.js	`97.73% <100.00%> (+<0.01%)`	⬆️
lib/internal/crypto/ec.js	`96.89% <100.00%> (+0.01%)`	⬆️
lib/internal/crypto/hash.js	`98.14% <100.00%> (+<0.01%)`	⬆️
lib/internal/crypto/hashnames.js	`100.00% <100.00%> (ø)`
lib/internal/crypto/keys.js	`98.04% <100.00%> (ø)`
lib/internal/crypto/ml_dsa.js	`97.37% <100.00%> (+0.01%)`	⬆️
lib/internal/crypto/ml_kem.js	`95.33% <100.00%> (+0.01%)`	⬆️
lib/internal/crypto/rsa.js	`94.89% <100.00%> (ø)`
... and 5 more

... and 30 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-08-07T22:25:59Z

CI: https://ci.nodejs.org/job/node-test-pull-request/75630/

nodejs-github-bot · 2026-08-09T19:10:31Z