Description
Description
After upgrading to version 2.0.0, decrypt
throws when using single line private key. (without pvk header/footer and without line breaks). As reported in node-saml/passport-saml#672 and GluuFederation/inbound-saml#154 .
This is happening because 'node-forge' used to accept a "single line" certificate in private_key = pki.privateKeyFromPem(options.key)
(check commit 7aaa734). But now, after this commit, crypto
module is in use:
node-xml-encryption/lib/xmlenc.js
Line 258 in e8df80c
Provide a clear and concise description of the issue, including what you expected to happen.
Reproduction
const rsaKey = fs.readFileSync(__dirname + '/your_private_key.key')
.replace(/(\r\n|\n|\r)/gm, '')
.replace('-----BEGIN RSA PRIVATE KEY-----', '')
.replace('-----END RSA PRIVATE KEY-----', '')
const options = {
key: rsaKey
}
xmlenc.decrypt('<xenc:EncryptedData ..... </xenc:EncryptedData>', options, function(err, result) {
if(err) {
throw new Error(err)
}
console.log(result);
}
output:
Error: error:0909006C:PEM routines:get_name:no start line
at Object.privateDecrypt (node:internal/crypto/cipher:79:12)
at decryptKeyInfoWithScheme (/root/inbound-saml-0.17.0/node_modules/xml-encryption/lib/xmlenc.js:258:26)
at decryptKeyInfo (/root/inbound-saml-0.17.0/node_modules/xml-encryption/lib/xmlenc.js:246:14)
at Object.decrypt (/root/inbound-saml-0.17.0/node_modules/xml-encryption/lib/xmlenc.js:187:24)
Environment
Please provide the following:
- Version of this library used: 2.0.0
Adicional Context
Even if that depends on a lib (node-forge/crypto), this change caused downstream modules to BREAK, so from a design perspective it's still an UNDOCUMENTED BREAKING CHANGE, even that it may also be treated as a bug to (hot)fix.