[CryptoService] Leverage browser native Crypto API to hash strings.

extensions/amp-analytics/0.1/crypto-impl.js

@@ -16,31 +16,77 @@
 
 import * as lib from '../../../third_party/closure-library/sha384-generated';
 import {getService} from '../../../src/service';
+import {dev} from '../../../src/log';
+
+/** @const {string} */
+const TAG = 'Crypto';
 
 export class Crypto {
 
  constructor(win) {
- this.win = win;
+ /** @private @const {?SubtleCrypto} */
+ this.subtle_ = getSubtle(win);
  }
 
  /**
- * Returns the SHA-384 hash of the input string in an ArrayBuffer.
+ * Returns the SHA-384 hash of the input string in a number array.
+ * Input string cannot contain chars out of range [0,255].
  * @param {string} str
- * @returns {!Promise<!ArrayBuffer>}
+ * @returns {!Promise<!Array<number>>}
+ * @throws {!Error} when input string contains chars out of range [0,255]
  */
  sha384(str) {
+ if (this.subtle_) {
+ try {
+ return this.subtle_.digest('SHA-384', str2ab(str))
+ // [].slice.call(Unit8Array) is a shim for Array.from(Unit8Array)
+ .then(buffer => [].slice.call(new Uint8Array(buffer)),
+ e => {
+ dev.info(TAG, 'Crypto digest promise has rejected, ' +
+ 'fallback to closure lib.', e);
+ return lib.sha384(str);
+ });
+ } catch (e) {
+ dev.info(TAG, 'Crypto digest has thrown, fallback to closure lib.', e);
+ }
+ }
  return Promise.resolve(lib.sha384(str));
  }
 
  /**
  * Returns the SHA-384 hash of the input string in the format of web safe
- * base64 string (using -_. instead of +/=).
+ * base64 (using -_. instead of +/=).
+ * Input string cannot contain chars out of range [0,255].
  * @param {string} str
  * @returns {!Promise<string>}
+ * @throws {!Error} when input string contains chars out of range [0,255]
  */
  sha384Base64(str) {
- return Promise.resolve(lib.sha384Base64(str));
+ return this.sha384(str).then(buffer => {
+ return lib.base64(buffer);
+ });
+ }
+}
+
+function getSubtle(win) {
+ if (!win.crypto) {
+ return null;
+ }
+ return win.crypto.subtle || win.crypto.webkitSubtle || null;
+}
+
+// A shim for TextEncoder
+function str2ab(str) {
+ const buf = new Uint8Array(str.length);
+ for (let i = 0; i < str.length; i++) {
+ // Apply the same check as in closure lib:
+ // https://github.com/google/closure-library/blob/master/closure/goog/crypt/sha2_64bit.js#L169
+ if (str.charCodeAt(i) > 255) {
+ throw Error('Characters must be in range [0,255]');
+ }
+ buf[i] = str.charCodeAt(i);
  }
+ return buf;
 }
 
 export function installCryptoService(win) {

extensions/amp-analytics/0.1/test/test-crypto-impl.js

@@ -15,31 +15,86 @@
  */
 
 import {Crypto} from '../crypto-impl';
+import {Platform} from '../../../../src/platform';
+import * as lib from '../../../../third_party/closure-library/sha384-generated';
+import * as sinon from 'sinon';
 
 describe('crypto-impl', () => {
 
- let crypto;
+ function testSuite(descption, crypto) {
+ describe(descption, () => {
+ it('should hash "abc" in sha384', () => {
+ return crypto.sha384('abc').then(buffer => {
+ expect(buffer.length).to.equal(48);
+ expect(buffer[0]).to.equal(203);
+ expect(buffer[1]).to.equal(0);
+ expect(buffer[47]).to.equal(167);
+ });
+ });
 
- beforeEach(() => {
- crypto = new Crypto({});
- });
+ it('should hash "abc" in sha384Base64', () => {
+ return expect(crypto.sha384Base64('abc')).to.eventually.equal(
+ 'ywB1P0WjXou1oD1pmsZQBycsMqsO3tFjGotgWkP_W-2AhgcroefMI1i67KE0yCWn');
+ });
+
+ it('should hash "foobar" in sha384Base64', () => {
+ return expect(crypto.sha384Base64('foobar')).to.eventually.equal(
+ 'PJww2fZl501RXIQpYNSkUcg6ASX9Pec5LXs3IxrxDHLqWK7fzfiaV2W_kCr5Ps8G');
+ });
 
- it('should hash "abc" in sha384', () => {
- return crypto.sha384('abc').then(buffer => {
- expect(buffer.length).to.equal(48);
- expect(buffer[0]).to.equal(203);
- expect(buffer[1]).to.equal(0);
- expect(buffer[47]).to.equal(167);
+ it('should throw when input contains chars out of range [0,255]', () => {
+ expect(() => crypto.sha384('abc今')).to.throw();
+ expect(() => crypto.sha384Base64('abc今')).to.throw();
+ });
  });
- });
+ }
 
- it('should hash "abc" in sha384Base64', () => {
- return expect(crypto.sha384Base64('abc')).to.eventually.equal(
-  'ywB1P0WjXou1oD1pmsZQBycsMqsO3tFjGotgWkP_W-2AhgcroefMI1i67KE0yCWn');
- });
+ function isModernChrome() {
+ const platform = new Platform(window);
+ return platform.isChrome() && platform.getMajorVersion() >= 45;
+ }
 
- it('should hash "foobar" in sha384Base64', () => {
- return expect(crypto.sha384Base64('foobar')).to.eventually.equal(
- 'PJww2fZl501RXIQpYNSkUcg6ASX9Pec5LXs3IxrxDHLqWK7fzfiaV2W_kCr5Ps8G');
+ testSuite('with native crypto API', new Crypto(window));
+ testSuite('with crypto lib', new Crypto({}));
+ testSuite('with native crypto API rejects', new Crypto({
+ crypto: {
+ subtle: {
+ digest: () => Promise.reject('Operation not supported'),
+ },
+ },
+ }));
+ testSuite('with native crypto API throws', new Crypto({
+ crypto: {
+ subtle: {
+ digest: () => {
+ throw new Error();
+ },
+ },
+ },
+ }));
+
+ it('native API result should exactly equal to crypto lib result', () => {
+ return Promise
+ .all([new Crypto(window).sha384('abc'), new Crypto({}).sha384('abc')])
+ .then(results => {
+ expect(results[0]).to.jsonEqual(results[1]);
+ });
  });
+
+ // Run this test only on browsers that we're confident about the existence
+ // of native Crypto API.
+ if (isModernChrome()) {
+ it('should not call closure lib when native API is available', () => {
+ const sandbox = sinon.sandbox.create();
+ const nativeApiSpy = sandbox.spy(window.crypto.subtle, 'digest');
+ const libSpy = sandbox.spy(lib, 'sha384');
+ return new Crypto(window).sha384Base64('abc').then(hash => {
+ expect(hash).to.equal(
+ 'ywB1P0WjXou1oD1pmsZQBycsMqsO3tFjGotgWkP_W-2AhgcroefMI1i67KE0yCWn');
+ expect(nativeApiSpy).to.have.been.calledOnce;
+ expect(libSpy).to.not.have.been.called;
+ });
+ sandbox.restore();
+ });
+ }
 });

third_party/closure-library/compile.sh

@@ -26,9 +26,10 @@ java -jar $1 \
  --js "$2/goog/debug/error.js" \
  --js "$2/goog/dom/nodetype.js" \
  --js "$2/goog/math/long.js" \
+ --js "$2/goog/reflect/reflect.js" \
  --js "$2/goog/string/string.js" \
  --js_output_file "sha384-generated.js" \
- --output_wrapper "/* Generated from closure library commit $GIT_COMMIT */%output%;export function sha384Base64(input) { return ampSha384(input) }; export function sha384(input) { return ampSha384Digest(input) };" \
+ --output_wrapper "/* Generated from closure library commit $GIT_COMMIT */%output%;export function base64(input) { return ampBase64(input) }; export function sha384(input) { return ampSha384Digest(input) };" \
  --manage_closure_dependencies \
  --process_closure_primitives \
  --use_types_for_optimization \