SEA decrypts string as number

amark / gun

An open source cybersecurity protocol for syncing decentralized graph data.

https://gun.eco/docs

Other

18.11k stars 1.16k forks source link

SEA decrypts string as number #804

Open sirpy opened 5 years ago

sirpy commented 5 years ago

If we save a value in scientific notation such as '4e2' with .secret and we decrypt it, it comes back as '400'. it seems it is being parsed as a number and not as string.

amark commented 5 years ago

@sirpy oye! What the heck?? I'd have no clue about this, I'm glad you mentioned it. Got some example code I can try it out with?

sirpy commented 5 years ago

gun.user().get('x').secret('4e2') then decrypt it.

amark commented 5 years ago

@sirpy do you mean SEA not gun.user()... yeah I can confirm, it is actually:

enc = await SEA.encrypt('4e2', 'asdf');
await SEA.decrypt(enc, 'asdf'); // 400

Wow, this is very odd. Definitely should be treated as a bug.

labs-dlugo commented 4 years ago

Number('4e2') returns 400, probably used by some JSON.parse in there?

labs-dlugo commented 4 years ago

Looks like it's caused by text-encoding here: https://github.com/amark/gun/blob/master/sea/decrypt.js#L29