Skip to content

hub/proxy: sanitize values of remember_me.split('$') #4399

Open
@haraldschilly

Description

@haraldschilly

proxy.coffee has this:

x    = opts.remember_me.split('$')
hash = auth.generate_hash(x[0], x[1], x[2], x[3])

and in auth: generate_hash = (algorithm, salt,...)hash = crypto.createHmac(algorithm, salt)

a stacktrace is

TypeError [ERR_INVALID_ARG_TYPE]: The "key" argument must be one of type string, TypedArray, or DataView. Received type undefined at new Hmac (internal/crypto/hash.js:88:11)
  at Object.createHmac (crypto.js:133:10)
  at Object.generate_hash (/cocalc/src/smc-hub/auth.js:116:21)
  at /cocalc/src/smc-hub/proxy.js:222:23
  ...

where the "key" it talks about is the second argument to createHmac :

@types/node/crypto.d.ts:
    function createHmac(algorithm: string, key: BinaryLike, options?: stream.TransformOptions): Hmac;

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions