Harden worker operation dispatch against unsafe dynamic method access

- operations.register/exists use Object.prototype.hasOwnProperty.call and a typeof guard so inherited Object.prototype members (toString, constructor, etc.) and the registry's own methods can no longer be resolved as crypto operations
- Add operations.get() safe accessor that returns the registered function or null
- worker.jsCryptoRunner validates via operations.get before invoking, removing both the throw-based DoS on unknown operationType and the unexpected-method invocation (CodeQL)
- Rebuild dist bundles
- Restore test iterations to 10

Author: ljoy913

dist/msrcrypto.js

@@ -42,24 +42,35 @@ var operations = {};
 
 operations.register = function(operationType, algorithmName, functionToCall) {
 
-    if (!operations[operationType]) {
+    if (!Object.prototype.hasOwnProperty.call(operations, operationType) ||
+        typeof operations[operationType] !== "object") {
         operations[operationType] = {};
     }
 
     var op = operations[operationType];
 
-    if (!op[algorithmName]) {
+    if (!Object.prototype.hasOwnProperty.call(op, algorithmName)) {
         op[algorithmName] = functionToCall;
     }
 
 };
 
 operations.exists = function(operationType, algorithmName) {
-    if (!operations[operationType]) {
+    if (!Object.prototype.hasOwnProperty.call(operations, operationType) ||
+        typeof operations[operationType] !== "object") {
         return false;
     }
 
-    return operations[operationType][algorithmName] ? true : false;
+    var op = operations[operationType];
+
+    return Object.prototype.hasOwnProperty.call(op, algorithmName) &&
+        typeof op[algorithmName] === "function";
+};
+
+operations.get = function(operationType, algorithmName) {
+    return operations.exists(operationType, algorithmName)
+        ? operations[operationType][algorithmName]
+        : null;
 };
 
 var scriptUrl = (function() {
@@ -849,11 +860,13 @@ var msrcryptoWorker = (function() {
             operationSubType = e.data.operationSubType;
 
             var operation = e.data.operationType,
+                algorithmName = e.data.algorithm.name,
                 result,
-                func = operations[operation][e.data.algorithm.name],
                 p = e.data;
 
-            if (!operations.exists(operation, e.data.algorithm.name)) {
+            var func = operations.get(operation, algorithmName);
+
+            if (!func) {
                 throw new Error("unregistered algorithm.");
             }
 

dist/msrcrypto.min.js

@@ -20,22 +20,35 @@ var operations = {};
 
 operations.register = function(operationType, algorithmName, functionToCall) {
 
-    if (!operations[operationType]) {
+    if (!Object.prototype.hasOwnProperty.call(operations, operationType) ||
+        typeof operations[operationType] !== "object") {
         operations[operationType] = {};
     }
 
     var op = operations[operationType];
 
-    if (!op[algorithmName]) {
+    if (!Object.prototype.hasOwnProperty.call(op, algorithmName)) {
         op[algorithmName] = functionToCall;
     }
 
 };
 
 operations.exists = function(operationType, algorithmName) {
-    if (!operations[operationType]) {
+    if (!Object.prototype.hasOwnProperty.call(operations, operationType) ||
+        typeof operations[operationType] !== "object") {
         return false;
     }
 
-    return operations[operationType][algorithmName] ? true : false;
+    var op = operations[operationType];
+
+    return Object.prototype.hasOwnProperty.call(op, algorithmName) &&
+        typeof op[algorithmName] === "function";
+};
+
+// Safe accessor: returns the registered function or null.
+// Never resolves to an inherited Object.prototype member.
+operations.get = function(operationType, algorithmName) {
+    return operations.exists(operationType, algorithmName)
+        ? operations[operationType][algorithmName]
+        : null;
 };

src/operations.js

@@ -42,11 +42,13 @@ var msrcryptoWorker = (function() {
             operationSubType = e.data.operationSubType;
 
             var operation = e.data.operationType,
+                algorithmName = e.data.algorithm.name,
                 result,
-                func = operations[operation][e.data.algorithm.name],
                 p = e.data;
 
-            if (!operations.exists(operation, e.data.algorithm.name)) {
+            var func = operations.get(operation, algorithmName);
+
+            if (!func) {
                 throw new Error("unregistered algorithm.");
             }
 

src/worker.js

@@ -43,7 +43,7 @@ function slowTest() {
 
 }
 
-// Microsoft Edges does not export key_ops or alg properties
+// Microsoft Edge does not export key_ops or alg properties
 // unless keyImport included those properties
 // So, generateKey will be missing key_ops & alg
 // This will check if this is happening
@@ -59,7 +59,7 @@ function slowTest() {
 
 var UseNative = false;
 var useWebWorkers = false;
-var iterations = 1;
+var iterations = 10;
 var skipSlowTests = true;
 var subtle = (UseNative && nativeCrypto) ? crypto.subtle : msrCrypto.subtle;
 var label = UseNative ? "(native)" : useWebWorkers ? "msrCrypto (workers)" : "msrCrypto";