setHMACKey with B64
TitusInfo opened this issue · comments
When running SHA.js in server-side classic ASP, there is a problem converting the HMACKey from Base-64, which causes an incorrect HMAC to be generated. The line
l = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(q[f]);
should be:
l = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".indexOf(q.charAt(f));
This is an easy enough fix but I'm shocked this hasn't cropped up in the last decade. Do you have an easy to repeat example of it breaking?
Can you try the sha.js in dceb277?
Brian:
Your syntax is ECMAScript 5, which is not fully supported by server-side ASP JavaScript in IIS. Your sha.js should work fine in modern browsers, which likely support ECMAScript 5. I have already changed my copy of sha.js to use the .charAt() function. Because of the obfuscated code, it took me three days to find this problem, and I have to move on to other issues.
Sincerely,
Stephen E. Stern, President
Titus Information Systems, Inc.
Phoenix, Arizona
From: Brian Turek [mailto:notifications@github.com]
Sent: Wednesday, March 25, 2020 1:56 AM
To: Caligatio/jsSHA <jsSHA@noreply.github.com>
Cc: TitusInfo <Programming@TitusInformationSystems.com>; Author <author@noreply.github.com>
Subject: Re: [Caligatio/jsSHA] setHMACKey with B64 (#81)
Can you try the sha.js in <dceb277> dceb277?
…_____
From: Brian Turek [mailto:notifications@github.com]
Sent: Tuesday, March 24, 2020 10:24 PM
To: Caligatio/jsSHA <jsSHA@noreply.github.com>
Cc: TitusInfo <Programming@TitusInformationSystems.com>; Author <author@noreply.github.com>
Subject: Re: [Caligatio/jsSHA] setHMACKey with B64 (#81)
This is an easy enough fix but I'm shocked this hasn't cropped up in the last decade. Do you have an easy to repeat example of it breaking?
Completely understand. I realize it doesn't help much now but src_dev.js is the plaintext version which gets "compressed" into sha.js