same Version, same Code, get different result

[maks]

Node Version: v8.11.3
Platform: win10x64、win8.1x64
Subsystem: crypto

"webpack": "^3.6.0",
"webpack-bundle-analyzer": "^2.9.0",
"webpack-dev-server": "^2.9.1",
"webpack-merge": "^4.1.0"
"autoprefixer": "^7.1.2",
"babel-core": "^6.22.1",
"babel-helper-vue-jsx-merge-props": "^2.0.3",
"babel-loader": "^7.1.1",
"babel-plugin-syntax-jsx": "^6.18.0",
"babel-plugin-transform-runtime": "^6.22.0",
"babel-plugin-transform-vue-jsx": "^3.5.0",
"babel-preset-env": "^1.3.2",
"babel-preset-stage-2": "^6.22.0",

yarn.lock

browserify-aes@^1.0.0, browserify-aes@^1.0.4:
  version "1.2.0"
  resolved "https://registry.yarnpkg.com/browserify-aes/-/browserify-aes-1.2.0.tgz#326734642f403dabc3003209853bb70ad428ef48"
  dependencies:
    buffer-xor "^1.0.3"
    cipher-base "^1.0.0"
    create-hash "^1.1.0"
    evp_bytestokey "^1.0.3"
    inherits "^2.0.1"
    safe-buffer "^5.0.1"

browserify-cipher@^1.0.0:
  version "1.0.1"
  resolved "https://registry.yarnpkg.com/browserify-cipher/-/browserify-cipher-1.0.1.tgz#8d6474c1b870bfdabcd3bcfcc1934a10e94f15f0"
  dependencies:
    browserify-aes "^1.0.4"
    browserify-des "^1.0.0"
    evp_bytestokey "^1.0.0"

browserify-des@^1.0.0:
  version "1.0.1"
  resolved "https://registry.yarnpkg.com/browserify-des/-/browserify-des-1.0.1.tgz#3343124db6d7ad53e26a8826318712bdc8450f9c"
  dependencies:
    cipher-base "^1.0.1"
    des.js "^1.0.0"
    inherits "^2.0.1"

browserify-rsa@^4.0.0:
  version "4.0.1"
  resolved "https://registry.yarnpkg.com/browserify-rsa/-/browserify-rsa-4.0.1.tgz#21e0abfaf6f2029cf2fafb133567a701d4135524"
  dependencies:
    bn.js "^4.1.0"
    randombytes "^2.0.1"

a.js

const crypto = require('crypto'); 

const decipher = crypto.createDecipheriv('des-cbc', '4f09dfdc', '4f09dfdc');
let plainText = decipher.update('09AE46D3A5212346858934B037B65A0342EFA5A7D19683B13A2671813899DFB7', 'hex', 'utf8');
plainText += decipher.final('utf8');
console.log('plainText:', plainText);

> node a.js

the code above works well in the dos cmd environment. But when it's packed into an independent js file by webpack and inserted into a static html. It went wrong. The console message always looks like this:

When I modify the file a.js a bit, it works well again:
modified code in static html and independent js:

var crypto= require("crypto");
const keyHex1 = Buffer.from('4f09dfdc', 'utf8');
const ivHex1 = Buffer.from('4f09dfdc', 'utf8');
const decipher = crypto.createDecipheriv('des-cbc', keyHex1, ivHex1);
let plainText2 = decipher.update('09AE46D3A5212346858934B037B65A0342EFA5A7D19683B13A2671813899DFB7', 'hex', 'utf8');
plainText2 += decipher.final('utf8');
console.log('plainText2:', plainText2);

All my files are encode in 'utf-8'. I'm sure of it.
The padding i'm using is 'PKCS5' with java 'DES/CBC/PKCS5Padding'
The PKcs5/PKcs7 padding seems broken. I don't think it make any sense.

[Calvin Metcalf]

there was a bug in how non buffer key and ivs were used, fixed by browserify/browserify-des#3