nodejs/node

Runtime-deprecate calling digest() on HMAC more than once

已关闭

#62,838 创建于 2026年4月20日

 (11 条评论) (6 个反应) (0 位负责人)JavaScript (35,535 个派生)batch import
cryptogood first issuesecurity

仓库指标

星标
 (117,218 个星标)
PR 合并指标
 (平均合并 18天 17小时) (30 天内合并 219 个 PR)

描述

(Upd: detected by the scanner behind @deepview-autofix)

Hash behavior is reasonable:

> hash = require('crypto').createHash('sha256').update('data')
> hash.digest()
<Buffer 3a 6e b0 79 0f 39 ac 87 c9 4f 38 56 b2 dd 2c 5d 11 0e 68 11 60 22 61 a9 a9 23 d3 bb 23 ad c8 b7>
> hash.digest()
Uncaught Error [ERR_CRYPTO_HASH_FINALIZED]: Digest already called
    at Hash.digest (node:internal/crypto/hash:155:11) {
  code: 'ERR_CRYPTO_HASH_FINALIZED'
}

But HMAC, on the other hand, returns empty buffers on further .digest() calls, likely for compat reasons:

> hmac = require('crypto').createHmac('sha256', 'key').update('data')
> hmac.digest()
<Buffer 50 31 fe 3d 98 9c 6d 15 37 a0 13 fa 6e 73 9d a2 34 63 fd ae c3 b7 01 37 d8 28 e3 6a ce 22 1b d0>
> hmac.digest()
<Buffer >

This is a footgun with potential security risks, and should be first runtime-deprecated, then removed if no breakage is detected.


贡献者指南