crypto: fix cross-realm ArrayBuffer validation

[fforbeck]

Problem

The Web Crypto API in Node.js v22+ fails to properly validate ArrayBuffer instances
created in different JavaScript realms. When an ArrayBuffer from a different realm
is passed to SubtleCrypto.digest(), it fails with:

TypeError: Failed to execute 'digest' on 'SubtleCrypto': 2nd argument is not instance of ArrayBuffer, Buffer, TypedArray, or DataView.

This is a common issue when:

1. Using TypedArray.buffer with ArrayBuffers created in worker threads
2. Using TypedArray.buffer with ArrayBuffers created in VM contexts
3. In some cases, when libraries load in different contexts in bundled applications

The problem is in isNonSharedArrayBuffer() which checks using prototype
inheritance (ObjectPrototypeIsPrototypeOf(ArrayBufferPrototype, V)) which fails
for cross-realm objects, even though structurally they are valid ArrayBuffers.

Solution

This PR modifies isNonSharedArrayBuffer() to use isArrayBuffer from internal/util/types to properly check for cross-realm objects.

Testing

Added a new test that verifies that ArrayBuffers created in different VM contexts
are correctly recognized as valid inputs to SubtleCrypto.digest().

Workaround

Until this fix is merged, users can work around this issue by wrapping cross-realm ArrayBuffers in a TypedArray view before passing them to WebCrypto functions. Here's a simple example demonstrating the workaround:

'use strict';

// Create a cross-realm ArrayBuffer
const vm = require('vm');
const context = vm.createContext({});
const crossRealmBuffer = vm.runInContext('new ArrayBuffer(16)', context);

// Fill it with some data
const view = new Uint8Array(crossRealmBuffer);
for (let i = 0; i < view.length; i++) {
  view[i] = i % 256;
}

// This will fail without the fix:
// crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, crossRealmBuffer);

// Workaround: Use the TypedArray view instead
const ciphertext = await crypto.subtle.encrypt(
  { name: 'AES-GCM', iv },
  key,
  view  // Use the view instead of the cross-realm buffer
);

Ref: storacha/w3up#1591

[nodejs-github-bot]

Review requested:

• @nodejs/actions
• @nodejs/releasers
• @nodejs/tsc

[legendecas]

In general, a patch should land on the main branch first. The same patch can apply to the main branch:

node/lib/internal/crypto/webidl.js

Lines 196 to 198 in 795dd8e

	function isNonSharedArrayBuffer(V) {
	return ObjectPrototypeIsPrototypeOf(ArrayBufferPrototype, V);
	}

.

Would you mind re-target the PR to the main branch? Thank you

[jasnell]

This PR should target the main branch not the nodejs:v22.x branch.

[fforbeck]

Thanks for the review @jasnell, @ljharb, and @legendecas. This is ready for another round.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/66261/

[jasnell]

Alternatively this could be:

const isNonSharedArrayBuffer = isArrayBuffer;

Also, should isSharedArrayBuffer(...) also be similarly updated here?

[BridgeAR]

I would actually just remove the method and use isArrayBuffer() directly instead. It should be clear that it's not shared.

[ljharb]

I'm confused - a SharedArrayBuffer is also an ArrayBuffer, in terms of internal slots - what actual check does isArrayBuffer perform?

[legendecas]

util.types.isArrayBuffer() invokes v8::Value::isArrayBuffer, which returns false if it is a SharedArrayBuffer: https://source.chromium.org/chromium/chromium/src/+/main:v8/src/api/api.cc;l=3534-3538?q=Value::IsArrayBuffer.

[ljharb]

(with or without "remove isNonSharedArrayBuffer and use isArrayBuffer" directly)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.27%. Comparing base (29af9ce) to head (607a044).
Report is 53 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #57828      +/-   ##
==========================================
+ Coverage   90.24%   90.27%   +0.03%     
==========================================
  Files         630      630              
  Lines      185670   186140     +470     
  Branches    36405    36481      +76     
==========================================
+ Hits       167555   168045     +490     
+ Misses      10998    10971      -27     
- Partials     7117     7124       +7     

Files with missing lines	Coverage Δ
lib/internal/crypto/webidl.js	98.48% <100.00%> (-0.01%)	⬇️

... and 75 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[aduh95]

There's a linter and a test error that would need to be adressed, let us know if you need help.

[fforbeck]

There's a linter and a test error that would need to be adressed, let us know if you need help.

can you point out which test it that? thank you!

[aduh95]

There's a linter and a test error that would need to be adressed, let us know if you need help.

can you point out which test it that? thank you!

You can find it in the CI output, here it is:

=== release test-crypto-subtle-cross-realm ===
Path: parallel/test-crypto-subtle-cross-realm
Error: --- stderr ---
node:internal/modules/cjs/loader:1408
  throw err;
  ^

Error: Cannot find module 'internal/util/types'
Require stack:
- /home/runner/work/node/node/node/test/parallel/test-crypto-subtle-cross-realm.js
    at Function._resolveFilename (node:internal/modules/cjs/loader:1405:15)
    at defaultResolveImpl (node:internal/modules/cjs/loader:1061:19)
    at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1066:22)
    at Function._load (node:internal/modules/cjs/loader:1215:37)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:235:24)
    at Module.require (node:internal/modules/cjs/loader:1491:12)
    at require (node:internal/modules/helpers:135:16)
    at Object.<anonymous> (/home/runner/work/node/node/node/test/parallel/test-crypto-subtle-cross-realm.js:10:27)
    at Module._compile (node:internal/modules/cjs/loader:1734:14) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [
    '/home/runner/work/node/node/node/test/parallel/test-crypto-subtle-cross-realm.js'
  ]
}

Node.js v24.0.0-pre
Command: out/Release/node --test-reporter=./test/common/test-error-reporter.js --test-reporter-destination=stdout /home/runner/work/node/node/node/test/parallel/test-crypto-subtle-cross-realm.js

===
=== 1 tests failed
===

[fforbeck]

@aduh95 - I've made the change to enable the internal modules, but I can't trigger the test workflow. Can you help? Thanks

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/66332/

[fforbeck]

@aduh95 I've fixed the test and fixed the commit message. Can you approve the workflow execution again? Thank you!

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/66411/

[aduh95]

Landed in 6bf7fd7