Skip to content

Commit cc32ad6

Browse files
committed
MLE-24397 - fix reported issue on Linux FIPS around exception caused by default load of FIPS-forbidden MD5 digest algorithm. Incorporate the source from the abandoned www-authenticate project to lib/www-authenticate-patched, and fix in place.
Changes to www-authenticate-patched include: removal of unnecessary pre-load of MD5 digester function from www-authenticate and md5 js files, use of Buffer.from rather than new Buffer (deprecated), and moving a prototype decl to after function has been defined. Add Progress copyright and typedef comment to Authenticator.
1 parent 3a5f3fc commit cc32ad6

File tree

4 files changed

+22
-8
lines changed

4 files changed

+22
-8
lines changed

lib/www-authenticate-patched/md5.js

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,4 @@
1-
var crypto= require('crypto')
2-
, md5sum = crypto.createHash('md5')
3-
;
1+
var crypto= require('crypto');
42

53
function md5(s) {
64
return crypto.createHash('md5').update(s).digest('hex');

lib/www-authenticate-patched/parsers.js

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,6 @@ function Parse_WWW_Authenticate(to_parse)
8888
}
8989
}
9090

91-
Parse_Authentication_Info.prototype.parse_params= parse_params;
92-
9391
function Parse_Authentication_Info(to_parse)
9492
{
9593
this.scheme= 'Digest';
@@ -102,6 +100,7 @@ function Parse_Authentication_Info(to_parse)
102100
}
103101
}
104102

103+
Parse_Authentication_Info.prototype.parse_params= parse_params;
105104
Parse_WWW_Authenticate.prototype.parse_params= parse_params;
106105

107106
module.exports = {

lib/www-authenticate-patched/user-credentials.js

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,9 @@ function user_credentials(username,password,options) {
1616
''
1717
:
1818
(!password && password !== '' ?
19-
new Buffer(username, "ascii").toString("base64")
19+
Buffer.from(username, "ascii").toString("base64")
2020
:
21-
new Buffer(username+':'+password, "ascii").toString("base64")
21+
Buffer.from(username+':'+password, "ascii").toString("base64")
2222
)
2323
function Credentials()
2424
{

lib/www-authenticate-patched/www-authenticate.js

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,13 @@
77
* Licensed under the MIT license.
88
*/
99

10+
/*
11+
* Copyright © 2015-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
12+
*/
13+
1014
'use strict';
1115

1216
var crypto= require('crypto')
13-
, md5sum = crypto.createHash('md5')
1417
, parsers= require('./parsers')
1518
, md5= require('./md5')
1619
, user_credentials= require('./user-credentials')
@@ -40,6 +43,20 @@ var www_authenticator = function(username,password,options)
4043
cnonce= options.cnonce;
4144
}
4245
if (cnonce === void 0) cnonce= crypto.pseudoRandomBytes(8).toString('hex');
46+
47+
/**
48+
* @typedef {Object} Authenticator
49+
* @property {any} [err]
50+
* @property {function(string=, string=): string} [authorize]
51+
* @property {any} [parms]
52+
* @property {string} [cnonce]
53+
*/
54+
55+
/**
56+
* Parses the WWW-Authenticate header.
57+
* @param {string} www_authenticate
58+
* @returns {Authenticator}
59+
*/
4360
var parse_header= function(www_authenticate)
4461
{
4562
function Authenticator()

0 commit comments

Comments
 (0)