xml-encryption - npm Package Compare versions

Comparing version 0.7.0 to 0.7.1

lib/xmlenc.js

@@ -142,7 +142,14 @@ var crypto = require('crypto');
         decipher.setAutoPadding(false);
-        decrypted = decipher.update(encrypted.slice(16), null, 'utf8') + decipher.final('utf8');
+        decrypted = decipher.update(encrypted.slice(16), null, 'binary') + decipher.final('binary');
 
         // Remove padding bytes equal to the value of the last byte of the returned data.
-        decrypted = decrypted.substr(0, decrypted.length - decrypted.charCodeAt(decrypted.length - 1));
-
+        padding = decrypted.charCodeAt(decrypted.length - 1);
+        if (1 <= padding && padding <= 16) {
+          decrypted = decrypted.substr(0, decrypted.length - padding);
+        } else {
+          callback(new Error('padding length invalid'));
+          return;
+        }
+        
+        decrypted = new Buffer(decrypted, 'binary').toString('utf8');
         break;
@@ -153,11 +160,20 @@ case 'http://www.w3.org/2001/04/xmlenc#aes256-cbc':
         decipher.setAutoPadding(false);
-        decrypted = decipher.update(encrypted.slice(16), null, 'utf8') + decipher.final('utf8');
+        decrypted = decipher.update(encrypted.slice(16), null, 'binary') + decipher.final('binary');
 
         // Remove padding bytes equal to the value of the last byte of the returned data.
-        decrypted = decrypted.substr(0, decrypted.length - decrypted.charCodeAt(decrypted.length - 1));
-
+        padding = decrypted.charCodeAt(decrypted.length - 1);
+        if (1 <= padding && padding <= 16) {
+          decrypted = decrypted.substr(0, decrypted.length - padding);
+        } else {
+          callback(new Error('padding length invalid'));
+          return;
+        }
+        
+        decrypted = new Buffer(decrypted, 'binary').toString('utf8');
         break;
       case 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc':
         decipher = crypto.createDecipheriv('des-ede3-cbc', symmetricKey, encrypted.slice(0,8)); 
-        decrypted = decipher.update(encrypted.slice(8), null, 'utf8') + decipher.final('utf8');
+        decrypted = decipher.update(encrypted.slice(8), null, 'binary') + decipher.final('binary');
+
+        decrypted = new Buffer(decrypted, 'binary').toString('utf8');
         break;
@@ -164,0 +180,0 @@ default:

package.json

 {
   "name": "xml-encryption",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "devDependencies": {
@@ -5,0 +5,0 @@ "mocha": "*",

test/xmlenc.encryptedkey.js

@@ -47,5 +47,5 @@ var assert = require('assert'),
 
-    xmlenc.encrypt('Gnügge', options, function(err, result) {  
+    xmlenc.encrypt('Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge', options, function(err, result) {  
       xmlenc.decrypt(result, { key: fs.readFileSync(__dirname + '/test-auth0.key')}, function(err, decrypted) {
-        assert.equal(decrypted, 'Gnügge');
+        assert.equal(decrypted, 'Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge');
         done();
@@ -56,3 +56,3 @@ });
 
-  it('should encrypt and decrypt xml (aes128-cbc)', function (done) {
+  it('should encrypt and decrypt xml (aes128-cbc) with utf8 chars', function (done) {
     // cert created with:
@@ -71,2 +71,19 @@ // openssl req -x509 -new -newkey rsa:2048 -nodes -subj '/CN=auth0.auth0.com/O=Auth0 LLC/C=US/ST=Washington/L=Redmond' -keyout auth0.key -out auth0.pem
 
+    xmlenc.encrypt('Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge', options, function (err, result) {
+      xmlenc.decrypt(result, { key: fs.readFileSync(__dirname + '/test-auth0.key')}, function (err, decrypted) {
+        assert.equal(decrypted, 'Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge Gnügge');
+        done();
+      });
+    });
+  });
+
+  it('should encrypt and decrypt xml (aes128-cbc)', function (done) {
+    var options = {
+      rsa_pub: fs.readFileSync(__dirname + '/test-auth0_rsa.pub'),
+      pem: fs.readFileSync(__dirname + '/test-auth0.pem'),
+      key: fs.readFileSync(__dirname + '/test-auth0.key'),
+      encryptionAlgorithm: 'http://www.w3.org/2001/04/xmlenc#aes128-cbc',
+      keyEncryptionAlgorighm: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p'
+    };
+
     xmlenc.encrypt('content to encrypt', options, function (err, result) {
@@ -73,0 +90,0 @@ xmlenc.decrypt(result, { key: fs.readFileSync(__dirname + '/test-auth0.key')}, function (err, decrypted) {

No alert changes

Improved metrics

Total package byte prevSize

48615

increased by3.39%

Lines of code

352

increased by9.32%

No dependency changes