Bug 282578

Summary: [WebCrypto] X25519 allows unwrapping a non-extractable key as extractable
Product: WebKit Reporter: Javier Fernandez <jfernandez>
Component: BindingsAssignee: Javier Fernandez <jfernandez>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, jfernandez, nitinmahendru, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on: 282780    
Bug Blocks:    
Attachments:
Description Flags
Test case to reproduce the bug none

Javier Fernandez
Reported 2024-11-04 17:01:05 PST
Created attachment 473138 [details] Test case to reproduce the bug STEPS TO REPRODUCE THE PROBLEM 1- Load the attached test case EXPECTED RESULT The last unwrapKey call should fail with the following error: "Unwrapping a non-extractable JWK as extractable fails as expected with DataError " ACTUAL RESULT The unwrapKey succeeds and the following message is shown in the console: "CONSOLE LOG Unwrapping a non-extractable JWK as extractable succeeded, but it should not !"
Attachments
Test case to reproduce the bug (7.95 KB, text/html)
2024-11-04 17:01 PST, Javier Fernandez 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Javier Fernandez
Comment 1 2024-11-04 17:03:18 PST
This is the root cause of the failure in the wrapKey_unwrapKey.https.any.html, shown in the wpt.fyi [1] https://wpt.fyi/results/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey.https.any.html?label=experimental&label=master&aligned WebKit is the only engine shown this error.
Javier Fernandez
Comment 2 2024-11-05 06:59:56 PST
Pull request: https://github.com/WebKit/WebKit/pull/36184
Radar WebKit Bug Importer
Comment 3 2024-11-24 21:45:09 PST
<rdar://problem/140525128>
Alexey Proskuryakov
Comment 4 2024-11-24 21:45:43 PST
The PR is still in Draft at this time.
EWS
Comment 5 2024-12-03 03:53:53 PST
Committed 287273@main (049cd4cf1bf9): <https://commits.webkit.org/287273@main> Reviewed commits have been landed. Closing PR #36184 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.