crypto,fs: reject invalid encodings by panva · Pull Request #66247 · nodejs/node

panva · 2026-09-23T17:03:23Z

Reject unknown input encodings in crypto update() and filesystem string write methods, and unknown output encodings in Hash.digest() and Hmac.digest(), instead of silently falling back to UTF-8 or Buffer output.

Refs: #45990
Fixes: #45189

Cipher.update(string, badEncoding, ...) and Decipher.update with the same shape silently produced incorrect output: the binding skipped the unrecognized encoding and fell back to a default, giving the user wrong ciphertext or plaintext with no signal. Sub-cases 1 and 2 from issue nodejs#45189 (bad output encoding to update/final) were addressed in PR nodejs#45990. This commit completes the fix for sub-case 3 (bad input encoding) per panva's comment deferring it to a follow-up PR for CITGM testing. When `data` is a string and `inputEncoding` is non-null but does not normalize to a known encoding, throw ERR_UNKNOWN_ENCODING. Buffer / TypedArray / DataView data paths are unaffected (the binding ignores `inputEncoding` for non-string data anyway). Fixes: nodejs#45189 Refs: nodejs#45990 Signed-off-by: Maruthan G <maruthang4@gmail.com>

Move unknown encoding validation into validateEncoding so Hash, Hmac, Sign, and Verify reject invalid string input encodings alongside Cipher and Decipher. Preserve ignored encodings for buffer inputs. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

Reject unknown Hash and Hmac digest encodings before finalizing the operation instead of silently returning a Buffer. Preserve buffer output aliases and existing encoding coercion. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

Pass an encoding rather than a string length to FileHandle.write. Cover invalid encodings in fs.write, fs.writeSync, and FileHandle.write, along with valid encodings and unchanged files after rejected writes. Rejecting previously accepted invalid encodings is an intentional semver-major bug fix shared with the crypto validation changes. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex

nodejs-github-bot · 2026-09-23T17:03:28Z

Review requested:

@nodejs/crypto

codecov · 2026-09-23T18:50:31Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.29%. Comparing base (624b447) to head (ba0704d).
⚠️ Report is 170 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #66247      +/-   ##
==========================================
- Coverage   90.30%   90.29%   -0.01%     
==========================================
  Files         789      789              
  Lines      272878   272892      +14     
  Branches    52105    52116      +11     
==========================================
+ Hits       246414   246417       +3     
- Misses      16923    16927       +4     
- Partials     9541     9548       +7

Files with missing lines	Coverage Δ
lib/internal/crypto/hash.js	`88.75% <100.00%> (+0.28%)`	⬆️
lib/internal/validators.js	`98.29% <100.00%> (+<0.01%)`	⬆️

... and 25 files with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nodejs-github-bot · 2026-09-25T06:00:28Z

CI: https://ci.nodejs.org/job/node-test-pull-request/77868/

panva · 2026-09-27T16:25:06Z

cc @nodejs/tsc for a second semver-major PRs that contain breaking changes and should be released in the next major version. approval

nodejs-github-bot · 2026-09-30T06:51:28Z

Landed in f71d644...822e8ef

Cipher.update(string, badEncoding, ...) and Decipher.update with the same shape silently produced incorrect output: the binding skipped the unrecognized encoding and fell back to a default, giving the user wrong ciphertext or plaintext with no signal. Sub-cases 1 and 2 from issue #45189 (bad output encoding to update/final) were addressed in PR #45990. This commit completes the fix for sub-case 3 (bad input encoding) per panva's comment deferring it to a follow-up PR for CITGM testing. When `data` is a string and `inputEncoding` is non-null but does not normalize to a known encoding, throw ERR_UNKNOWN_ENCODING. Buffer / TypedArray / DataView data paths are unaffected (the binding ignores `inputEncoding` for non-string data anyway). Fixes: #45189 Refs: #45990 Signed-off-by: Maruthan G <maruthang4@gmail.com> PR-URL: #66247 Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Move unknown encoding validation into validateEncoding so Hash, Hmac, Sign, and Verify reject invalid string input encodings alongside Cipher and Decipher. Preserve ignored encodings for buffer inputs. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #66247 Fixes: #45189 Refs: #45990 Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Reject unknown Hash and Hmac digest encodings before finalizing the operation instead of silently returning a Buffer. Preserve buffer output aliases and existing encoding coercion. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #66247 Fixes: #45189 Refs: #45990 Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Pass an encoding rather than a string length to FileHandle.write. Cover invalid encodings in fs.write, fs.writeSync, and FileHandle.write, along with valid encodings and unchanged files after rejected writes. Rejecting previously accepted invalid encodings is an intentional semver-major bug fix shared with the crypto validation changes. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex PR-URL: #66247 Fixes: #45189 Refs: #45990 Reviewed-By: Xuguang Mei <meixuguang@gmail.com> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>

Notable changes: async_hooks: * (SEMVER-MAJOR) remove legacy AsyncLocalStorage implementation (Matteo Collina) #63641 benchmark: * (SEMVER-MAJOR) protect against accidental fork bomb (James M Snell) #66132 build: * (SEMVER-MAJOR) remove the bundled FIPS provider build (Filip Skokan) #64777 * (SEMVER-MAJOR) require OpenSSL 3 or later (Filip Skokan) #64777 * (SEMVER-MAJOR) downgrade Intel macOS support to experimental (Antoine du Hamel) #65427 crypto: * (SEMVER-MAJOR) move DEP0093 to End-of-Life (Filip Skokan) #64777 * (SEMVER-MAJOR) remove legacy OpenSSL code paths (Filip Skokan) #64777 * (SEMVER-MAJOR) validate digest output encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate update input encodings (Filip Skokan) #66247 * (SEMVER-MAJOR) validate inputEncoding in Cipher/Decipher update (Maruthan G) #66247 * (SEMVER-MAJOR) move DEP0198 to End-of-Life (Filip Skokan) #64000 * (SEMVER-MAJOR) move DEP0203 and DEP0204 to End-of-Life (Filip Skokan) #63188 * (SEMVER-MAJOR) reject resizable backing stores in Web Crypto buffer parameters (Filip Skokan) #63925 * (SEMVER-MAJOR) throw on uninitialized DH computeSecret (Filip Skokan) #63922 * (SEMVER-MAJOR) runtime-deprecate calling Hmac.digest() more than once (Madelyn) #63624 crypto,https,tls: * (SEMVER-MAJOR) end OpenSSL engine support (Filip Skokan) #64777 deps: * (SEMVER-MAJOR) update archs files for openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) upgrade openssl sources to openssl-4.1.0 (Node.js GitHub Bot) #66971 * (SEMVER-MAJOR) remove ncrypto legacy OpenSSL backend (Filip Skokan) #64777 * (SEMVER-MAJOR) update V8 to 15.6.75.13 (Joyee Cheung) #66601 * (SEMVER-MAJOR) update V8 to 15.5.35.20 (Joyee Cheung) #66537 * (SEMVER-MAJOR) update V8 to 15.2.124.38 (Joyee Cheung) #65161 * (SEMVER-MAJOR) upgrade npm to 12.1.0 (npm team) #66212 dgram: * (SEMVER-MAJOR) skip the custom lookup for literal IP addresses (Ruben Bridgewater) #64131 dns: * (SEMVER-MAJOR) do not consult hosts file in reverse lookups (Archkon) #64268 * (SEMVER-MAJOR) stop using deprecated functions in `SetServers` (Antoine du Hamel) #64356 doc: * (SEMVER-MAJOR) remove OpenSSL 1.x references (Filip Skokan) #64777 * (SEMVER-MAJOR) update Node.js 27 official binary toolchains (Richard Lau) #66377 domain: * (SEMVER-MAJOR) runtime-deprecate the module (Matteo Collina) #65074 * (SEMVER-MAJOR) port to AsyncLocalStorage (Matteo Collina) #61095 fs: * (SEMVER-MAJOR) implement glob natively (Aviv Keller) #65392 * (SEMVER-MAJOR) return Buffer from mkdtemp when prefix is a Buffer (Hamid Reza Ghavami) #64397 http: * (SEMVER-MAJOR) reject responses exceeding header limit (Matteo Collina) #65010 * (SEMVER-MAJOR) runtime deprecate instantiating without new (Yagiz Nizipli) #64853 * (SEMVER-MAJOR) increase keepAliveTimeout default to 65 seconds (Tim Perry) #62782 * (SEMVER-MAJOR) make req.headers have a null prototype (Matteo Collina) #62900 * (SEMVER-MAJOR) reject addTrailers after finish (Ryuhei Shima) #62832 http2: * (SEMVER-MAJOR) increase default window sizes (Matteo Collina) #64623 lib: * (SEMVER-MAJOR) deprecate _http_* (Sebastian Beltran) #58535 * (SEMVER-MAJOR) insert argv[0] at argv[1] in setDeserializeMainFunction (Daijiro Wachi) #62928 * (SEMVER-MAJOR) use `Object.freeze` to avoid defensive cloning in `SourceMap` (Daijiro Wachi) #62830 * (SEMVER-MAJOR) reject SharedArrayBuffer in Blob constructor per spec (Ali Hassan) #63046 lib,src: * (SEMVER-MAJOR) remove `--no-experimental-websocket` CLI flag (Antoine du Hamel) #65284 net: * (SEMVER-MAJOR) race family autoselection attempts (Matteo Collina) #66229 * (SEMVER-MAJOR) throw on multiple listen calls (Matteo Collina) #64871 * (SEMVER-MAJOR) runtime-deprecate Server.prototype._listen2 (Guilherme Araújo) #64794 * (SEMVER-MAJOR) add experimental net/promises API (Ethan Arrowood) #63965 repl: * (SEMVER-MAJOR) use inspector over vm (Aviv Keller) #64034 src: * (SEMVER-MAJOR) officially deprecate `node::ObjectWrap` (Anna Henningsen) #63756 * (SEMVER-MAJOR) merge `CreateEnvironment()` overloads (Anna Henningsen) #63596 src, test: src,lib: * (SEMVER-MAJOR) add --allow-env permission (James M Snell) #66132 stream: * (SEMVER-MAJOR) destroy source when map iterator closes early (Y1D7NG) #64264 test: * (SEMVER-MAJOR) fix fs write encoding coverage (Filip Skokan) #66247 test,benchmark: * (SEMVER-MAJOR) drop OpenSSL 1.x-only coverage (Filip Skokan) #64777 test,tools: * (SEMVER-MAJOR) drop OpenSSL 1.x-era FIPS leftovers (Filip Skokan) #64777 test_runner: * use AsyncLocalStorage instead of async_hooks (Matteo Collina) #66795 tls: * (SEMVER-MAJOR) move _tls_* to end-of-life (Sebastian Beltran) #60658 zlib: * (SEMVER-MAJOR) convert classes to modern syntax and eol DEP0184 (Yagiz Nizipli) #64849 PR-URL: #67062

maruthang and others added 4 commits September 23, 2026 18:50

panva added semver-major PRs that contain breaking changes and should be released in the next major version. commit-queue-rebase PRs the Commit Queue should land as multiple self-contained commits. labels Sep 23, 2026

panva mentioned this pull request Sep 23, 2026

crypto: validate inputEncoding in Cipher/Decipher update #62954

Closed

nodejs-github-bot added crypto Issues and PRs related to the crypto subsystem. needs-ci PRs that need a full CI run. labels Sep 23, 2026

meixg approved these changes Sep 24, 2026

View reviewed changes

panva added author ready PRs with CI started, the required approvals, and no outstanding review comments. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Sep 24, 2026

panva requested a review from a team September 24, 2026 11:18

github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Sep 24, 2026

This comment was marked as outdated.

Sign in to view

RafaelGSS approved these changes Sep 24, 2026

View reviewed changes

This comment was marked as outdated.

Sign in to view

lpinca approved these changes Sep 24, 2026

View reviewed changes

panva requested a review from jasnell September 30, 2026 06:26

jasnell approved these changes Sep 30, 2026

View reviewed changes

panva added the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 30, 2026

nodejs-github-bot closed this Sep 30, 2026

nodejs-github-bot removed the commit-queue PRs queued for automated landing through the Commit Queue. label Sep 30, 2026

panva deleted the crypto-encoding-validation branch September 30, 2026 06:52

RafaelGSS mentioned this pull request Oct 27, 2026

2026-10-28, Version 27.0.0-alpha.0.0.0 (Alpha) #67062

Open

Navigation Menu

Repository navigation

crypto,fs: reject invalid encodings - #66247

crypto,fs: reject invalid encodings#66247
panva wants to merge 4 commits into
nodejs:mainfrom
panva:crypto-encoding-validation

panva commented Sep 23, 2026 •

edited

Loading

Uh oh!

nodejs-github-bot commented Sep 23, 2026

Uh oh!

codecov Bot commented Sep 23, 2026 •

edited

Loading

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

nodejs-github-bot commented Sep 25, 2026

Uh oh!

panva commented Sep 27, 2026

Uh oh!

nodejs-github-bot commented Sep 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

panva commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nodejs-github-bot commented Sep 23, 2026

Uh oh!

codecov Bot commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

This comment was marked as outdated.

This comment was marked as outdated.

nodejs-github-bot commented Sep 25, 2026

Uh oh!

panva commented Sep 27, 2026

Uh oh!

nodejs-github-bot commented Sep 30, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

panva commented Sep 23, 2026 •

edited

Loading

codecov Bot commented Sep 23, 2026 •

edited

Loading