Password is always "[object ArrayBuffer" #9
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Proposed fix looks good to be... |
|
👍 |
btoa expects a string argument, so when passing it the ArrayBuffer object returned by getRandomBytes(), it's converted to a string by calling .toString() on it. This always results in "[object ArrayBuffer]", effectively resulting in a completely non-random password.
|
Turned this issue into a pull request with the proposed fix attached. |
TheBlueMatt
pushed a commit
that referenced
this pull request
Apr 20, 2014
Password is always "[object ArrayBuffer"
|
@Ventero Can I get a confirmation you agree to license the above code as GPL? |
|
Sure. I doubt my change reaches any threshold of originality anyway, but you can consider it as being licensed under any GPL. |
1 task
1 task
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In
options.js:27, the password is generated asbtoa(getRandomBytes(16)).As documented on MDN,
btoaaccepts a string argument. However, sincegetRandomBytesreturns anArrayBuffer, it is implicitly converted to a string by calling.toString()on it - which for anArrayBufferreturns"[object ArrayBuffer]".In the next line, the last 2 characters of the Base64 encoded password are then removed, effectively setting
passwordtoW29iamVjdCBBcnJheUJ1ZmZlcl(or[object ArrayBufferwhen decoded).A possible fix for this would be something like: