Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
const encryptedSize = getDataLength(castEncryptedData);
// $FlowIKnow Already checked we are using a simple encryption
const clearSize = encryption.getClearSize(encryptedSize);
const progressHandler = new ProgressHandler(progressOptions).start(clearSize);
const resourceId = encryption.extractResourceId(castEncryptedData);
const key = await this._resourceManager.findKeyFromResourceId(resourceId);
let clearData;
try {
// $FlowIKnow Already checked we are using a simple encryption
clearData = encryption.decrypt(key, encryption.unserialize(castEncryptedData));
} catch (error) {
const b64ResourceId = utils.toBase64(resourceId);
throw new DecryptionFailed({ error, b64ResourceId });
}
const castClearData = await castData(clearData, outputOptions);
progressHandler.report(clearSize);
return castClearData;
}
transform: (encryptedChunk, encoding, done) => {
try {
const clearData = encryptionV4.decrypt(key, this._state.index, encryptionV4.unserialize(encryptedChunk));
this._decryptionStream.push(clearData);
} catch (error) {
return done(new DecryptionFailed({ error, b64ResourceId }));
}
this._state.lastEncryptedChunkSize = encryptedChunk.length;
this._state.index += 1; // safe as long as index < 2^53
done();
},
async decryptResourceKeyPublishedToGroup(keyPublishEntry: KeyPublishEntry): Promise {
if (!keyPublishEntry.recipient) {
throw new InternalError('Assertion error: key publish without recipient');
}
const encryptionKeyPair = await this._groupManager.getGroupEncryptionKeyPair(keyPublishEntry.recipient);
if (!encryptionKeyPair)
throw new DecryptionFailed({ message: 'Group not found' });
return tcrypto.sealDecrypt(keyPublishEntry.key, encryptionKeyPair);
}
async function decryptObject(key: Uint8Array, ciphertext: Uint8Array): Promise {
if (ciphertext.length < encryptionV1.overhead) {
throw new DecryptionFailed({ message: `truncated encrypted data. Length should be at least ${encryptionV1.overhead} for encryption v1` });
}
const jsonBytes = encryptionV1.compatDecrypt(key, ciphertext);
return JSON.parse(utils.toString(jsonBytes), (_k, v) => {
if (typeof v === 'string' && startsWith(v, base64Prefix))
return utils.fromBase64(v.substring(base64Prefix.length));
return v;
});
}
async decryptResourceKeyPublishedToUser(keyPublishEntry: KeyPublishEntry): Promise {
if (!keyPublishEntry.recipient) {
throw new InternalError('Assertion error: key publish without recipient');
}
const userKey = await this._localUserManager.findUserKey(keyPublishEntry.recipient);
if (!userKey)
throw new DecryptionFailed({ message: 'User key not found' });
return tcrypto.sealDecrypt(keyPublishEntry.key, userKey);
}
async findResourceKey(resourceId: Uint8Array): Promise {
try {
const b64ResourceId = utils.toBase64(resourceId);
const result = await this._ds.get(TABLE, b64ResourceId);
const encryptedKey = utils.fromBase64(result.b64EncryptedKey);
if (encryptedKey.length < encryptionV1.overhead) {
throw new DecryptionFailed({ message: `truncated encrypted data. Length should be at least ${encryptionV1.overhead} for encryption v1` });
}
return encryptionV1.compatDecrypt(this._userSecret, encryptedKey, resourceId);
} catch (e) {
if (e instanceof dbErrors.RecordNotFound) {
return;
}
throw e;
}
}
async decryptResourceKeyPublishedToProvisionalIdentity(keyPublishEntry: KeyPublishEntry): Promise {
if (!keyPublishEntry.recipientAppPublicKey || !keyPublishEntry.recipientTankerPublicKey) {
throw new InternalError('Assertion error: key publish without recipient');
}
const keys = await this._provisionalIdentityManager.getPrivateProvisionalKeys(keyPublishEntry.recipientAppPublicKey, keyPublishEntry.recipientTankerPublicKey);
if (!keys)
throw new DecryptionFailed({ message: 'Provisional user key not found' });
const d1 = tcrypto.sealDecrypt(keyPublishEntry.key, keys.tankerEncryptionKeyPair);
const d2 = tcrypto.sealDecrypt(d1, keys.appEncryptionKeyPair);
return d2;
}