8000 tls: introduce ERR_TLS_INVALID_CONTEXT · nodejs/node@7aa1df7 · GitHub
[go: up one dir, main page]
Skip to content

Commit 7aa1df7

Browse files
Trotttargos
Trott
authored and
targos
committed
tls: introduce ERR_TLS_INVALID_CONTEXT
It is trivially possible to cause an internal assertion error with tls.createSecurePair(). Throw a friendly error instead. Reserve internal assertions for things that we believe to be impossible. PR-URL: #30718 Reviewed-By: Sam Roberts <vieuxtech@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent e65ad86 commit 7aa1df7

File tree

4 files changed

+19
-4
lines changed

4 files changed

+19
-4
lines changed

‎doc/api/errors.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1809,6 +1809,14 @@ recommended to use 2048 bits or larger for stronger security.
18091809
A TLS/SSL handshake timed out. In this case, the server must also abort the
18101810
connection.
18111811

1812+
<a id="ERR_TLS_INVALID_CONTEXT">
1813+
### ERR_TLS_INVALID_CONTEXT
1814+
<!-- YAML
1815+
added: REPLACEME
1816+
-->
1817+
1818+
The context must be a `SecureContext`.
1819+
18121820
<a id="ERR_TLS_INVALID_PROTOCOL_METHOD"></a>
18131821
### ERR_TLS_INVALID_PROTOCOL_METHOD
18141822

‎lib/_tls_wrap.js‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ const {
5656
ERR_SOCKET_CLOSED,
5757
ERR_TLS_DH_PARAM_SIZE,
5858
ERR_TLS_HANDSHAKE_TIMEOUT,
59+
ERR_TLS_INVALID_CONTEXT,
5960
ERR_TLS_RENEGOTIATION_DISABLED,
6061
ERR_TLS_REQUIRED_SERVER_NAME,
6162
ERR_TLS_SESSION_ATTACK,
@@ -517,8 +518,9 @@ TLSSocket.prototype._wrapHandle = function(wrap) {
517518
options.credentials ||
518519
tls.createSecureContext(options);
519520
assert(handle.isStreamBase, 'handle must be a StreamBase');
520-
assert(context.context instanceof NativeSecureContext,
521-
'context.context must be a NativeSecureContext');
521+
if (!(context.context instanceof NativeSecureContext)) {
522+
throw new ERR_TLS_INVALID_CONTEXT('context');
523+
}
522524
const res = tls_wrap.wrap(handle, context.context, !!options.isServer);
523525
res._parent = handle; // C++ "wrap" object: TCPWrap, JSStream, ...
524526
res._parentWrap = wrap; // JS object: net.Socket, JSStreamSocket, ...

‎lib/internal/errors.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1169,6 +1169,7 @@ E('ERR_TLS_CERT_ALTNAME_INVALID', function(reason, host, cert) {
11691169
}, Error);
11701170
E('ERR_TLS_DH_PARAM_SIZE', 'DH parameter size %s is less than 2048', Error);
11711171
E('ERR_TLS_HANDSHAKE_TIMEOUT', 'TLS handshake timeout', Error);
1172+
E('ERR_TLS_INVALID_CONTEXT', '%s must be a SecureContext', TypeError),
11721173
E('ERR_TLS_INVALID_PROTOCOL_VERSION',
11731174
'%j is not a valid %s TLS protocol version', TypeError);
11741175
E('ERR_TLS_PROTOCOL_VERSION_CONFLICT',

‎test/parallel/test-tls-basic-validations.js‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,9 +78,13 @@ common.expectsError(
7878
assert.throws(() => tls.createServer({ ticketKeys: Buffer.alloc(0) }),
7979
/TypeError: Ticket keys length must be 48 bytes/);
8080

81-
common.expectsInternalAssertion(
81+
assert.throws(
8282
() => tls.createSecurePair({}),
83-
'context.context must be a NativeSecureContext'
83+
{
84+
message: 'context must be a SecureContext',
85+
code: 'ERR_TLS_INVALID_CONTEXT',
86+
name: 'TypeError',
87+
}
8488
);
8589

8690
{

0 commit comments

Comments
 (0)
0