nodejs/node

Runtime-deprecate calling digest() on HMAC more than once

已關閉

#62,838 建立於 2026年4月20日

 (11 則留言) (6 個反應) (0 位負責人)JavaScript (35,535 個分叉)batch import
cryptogood first issuesecurity

倉庫指標

星標
 (117,218 顆星)
PR 合併指標
 (平均合併 18天 17小時) (30 天內合併 219 個 PR)

描述

(Upd: detected by the scanner behind @deepview-autofix)

Hash behavior is reasonable:

> hash = require('crypto').createHash('sha256').update('data')
> hash.digest()
<Buffer 3a 6e b0 79 0f 39 ac 87 c9 4f 38 56 b2 dd 2c 5d 11 0e 68 11 60 22 61 a9 a9 23 d3 bb 23 ad c8 b7>
> hash.digest()
Uncaught Error [ERR_CRYPTO_HASH_FINALIZED]: Digest already called
    at Hash.digest (node:internal/crypto/hash:155:11) {
  code: 'ERR_CRYPTO_HASH_FINALIZED'
}

But HMAC, on the other hand, returns empty buffers on further .digest() calls, likely for compat reasons:

> hmac = require('crypto').createHmac('sha256', 'key').update('data')
> hmac.digest()
<Buffer 50 31 fe 3d 98 9c 6d 15 37 a0 13 fa 6e 73 9d a2 34 63 fd ae c3 b7 01 37 d8 28 e3 6a ce 22 1b d0>
> hmac.digest()
<Buffer >

This is a footgun with potential security risks, and should be first runtime-deprecated, then removed if no breakage is detected.


貢獻者指南