101a2a2 · bridge · git.iko.soy

keys: crash on non-buffer xor input

And make sure to pass in a buffer as the salt for auth-token-based networking keys.

commit101a2a2cca931268099607913ba5cb39703fe5e3 authorFang <git@fang.io> dateThu 23 Jul 2020, 23:10 (6 years ago) parentf6b288d

2 files changed+7−1

unifiedsplit

src/lib/keys.js+2−1

@@ -148,7 +148,8 @@ const deriveNetworkSeedFromMnemonic = async (

148148 * @return {Maybe<string>}

149149 */

150150export const deriveNetworkSeedFromAuthToken = (authToken, revision, point) => {

151− const networkSeed = shas(authToken, `revision-${point}-${revision}`)

151+ const salt = Buffer.from(`revision-${point}-${revision}`);

152+ const networkSeed = shas(authToken, salt)

152153 .toString('hex')

153154 .slice(0, 32);

154155 return Just(networkSeed);

src/lib/networkCode.js+5

@@ -23,6 +23,11 @@ export function shas(buf, salt) {

2323}

2424

2525function xor(a, b) {

26+ if (!Buffer.isBuffer(a) || !Buffer.isBuffer(b)) {

27+ console.log('a', a);

28+ console.log('b', b);

29+ throw new Error('only xor buffers!');

30+ }

2631 const length = Math.max(a.byteLength, b.byteLength);

2732 const result = new Uint8Array(length);

2833 for (let i = 0; i < length; i++) {