Commit bc55749
fix(common): use cryptographically secure SHA-256 for transfer cache key generation
Replace the custom 64-bit non-cryptographic combined DJB2 hashing implementation in HttpTransferCache with a robust, pure JavaScript, synchronous SHA-256 algorithm.
Using DJB2 is vulnerable to pre-image and second-preimage attacks due to its small 64-bit keyspace and mathematical simplicity. An attacker could craft colliding request inputs to poison the cache, potentially causing a CDN or the application to serve the wrong cached response to legitimate users.
SHA-256 provides strong cryptographic collision resistance, preventing cache key collision attacks. A custom synchronous implementation is required because the Web Crypto API (`crypto.subtle.digest`) is asynchronous, whereas the transfer cache state lookup and interceptor flow must operate synchronously.
Also, update the unit tests to dynamically verify the custom SHA-256 output against the native Web Crypto API.1 parent d846326 commit bc55749Copy full SHA for bc55749
4 files changed
+306-116Lines changed: 306 additions & 116 deletions
File tree
Expand file treeCollapse file tree
Open diff view settings
Filter options
- integration/platform-server-hydration
- packages
- common/http
- src
- test
- core/test/bundling/hydration
Expand file treeCollapse file tree
Open diff view settings
Collapse file
integration/platform-server-hydration/size.json
Copy file name to clipboard+2-2Lines changed: 2 additions & 2 deletions
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| ||
1 | 1 | |
2 | | - |
3 | | - |
| 2 | + |
| 3 | + |
4 | 4 | |
5 | 5 | |
0 commit comments