Skip to content

fix(rsa): validate modulus length before browser interop - #388

Merged
HamdaanAliQuatil merged 1 commit into
google:masterfrom
harrshita123:fix/rsa-modulus-length-validation
Sep 3, 2026
Merged

HamdaanAliQuatil merged 1 commit into
google:masterfrom
harrshita123:fix/rsa-modulus-length-validation

Conversation

@harrshita123

Copy link
Copy Markdown
Contributor

Summary

  • validate RSA modulusLength against the WebIDL unsigned-long range before backend dispatch
  • apply the shared validation to RSA-OAEP, RSA-PSS, and RSASSA-PKCS1-v1_5 key generation
  • add cross-backend regression coverage for negative and overflowing values

Motivation

The browser backend previously forwarded out-of-range modulusLength values to SubtleCrypto.generateKey. WebIDL conversion failures then escaped through Dart2JS as raw JSObject: TypeError values.

Validating at the shared public API boundary produces a consistent Dart ArgumentError before browser interop and avoids duplicating checks in individual backends.

Testing

  • dart analyze --fatal-warnings .
  • dart test test/webcrypto_test.dart -p vm
  • dart test test/webcrypto_test.dart -p chrome -c dart2js
  • dart test test/webcrypto_test.dart -p chrome -c dart2wasm
  • dart format --output=none --set-exit-if-changed on all changed Dart files
  • git diff --check

Fixes #387

@HamdaanAliQuatil
HamdaanAliQuatil merged commit ecf7b42 into google:master Sep 3, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: browser RSA key generation exposes raw JavaScript errors for out-of-range modulusLength

2 participants