fix: removes atob usage and fixes #24 (#25)

* feat: removes atob usage and fixes #24
cloudflare · Mar 11, 2024 · f47534f · f47534f
1 parent 285bb90
commit f47534f
Show file tree

Hide file tree

Showing 6 changed files with 58 additions and 9 deletions.
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -10,6 +10,7 @@
     "test": "cross-env NODE_OPTIONS=--experimental-vm-modules vitest run"
   },
   "dependencies": {
+    "@cfworker/base64url": "^1.12.5",
     "@tsndr/cloudflare-worker-jwt": "^2.5.1",
     "itty-router": "^4.0.27",
     "zod": "^3.22.4"

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
diff --git a/src/auth.ts b/src/auth.ts
@@ -1,3 +1,5 @@
+import { decode } from "@cfworker/base64url";
+
 export type RegistryTokenCapability = "push" | "pull";
 export type RegistryAuthProtocolTokenPayload = {
   username: string;
@@ -38,10 +40,7 @@ export function stripUsernamePasswordFromHeader(r: Request): [string, string] |
   }
 
   // Decodes the base64 value and performs unicode normalization.
-  // @see https://datatracker.ietf.org/doc/html/rfc7613#section-3.3.2 (and #section-4.2.2)
-  // @see https://dev.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/String/normalize
-  const buffer = Uint8Array.from(atob(encoded), (character) => character.charCodeAt(0));
-  const decoded = new TextDecoder().decode(buffer).normalize();
+  const decoded = decode(encoded);
 
   // The username & password are split by the first colon.
   //=> example: "username:password"

diff --git a/src/token.ts b/src/token.ts
@@ -1,3 +1,4 @@
+import { decode } from "@cfworker/base64url";
 import jwt from "@tsndr/cloudflare-worker-jwt";
 import {
   RegistryTokenCapability,
@@ -8,11 +9,7 @@ import {
 
 export function importKeyFromBase64(key: string): JsonWebKey {
   // Decodes the base64 value and performs unicode normalization.
-  // @see https://datatracker.ietf.org/doc/html/rfc7613#section-3.3.2 (and #section-4.2.2)
-  // @see https://dev.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/String/normalize
-  const buffer = Uint8Array.from(atob(key), (character) => character.charCodeAt(0));
-  const decoded = new TextDecoder().decode(buffer).normalize();
-  return JSON.parse(decoded);
+  return JSON.parse(decode(key));
 }
 
 export async function newRegistryTokens(jwtPublicKey: string): Promise<RegistryTokens> {

diff --git a/yarn.lock b/yarn.lock
@@ -7,6 +7,13 @@
   resolved "https://registry.npmjs.org/@aashutoshrathi/word-wrap/-/word-wrap-1.2.6.tgz"
   integrity sha512-1Yjs2SvM8TflER/OD3cOjhWWOZb58A2t7wpE2S9XfBYTiIl+XFhQG2bjy4Pu1I+EAlCNUzRDYDdFwFYUKvXcIA==
 
+"@cfworker/base64url@^1.12.5":
+  version "1.12.5"
+  resolved "https://registry.npmjs.org/@cfworker/base64url/-/base64url-1.12.5.tgz"
+  integrity sha512-pNLrz0D0MguzFLJisBUv+XOTkpRpRTIMI7/r2QwTWI2MR5VJ7Hysd6ug6DBWksKFy7TK3hCf+qejufdJSN5X+A==
+  dependencies:
+    rfc4648 "^1.5.2"
+
 "@cloudflare/[email protected]":
   version "0.3.1"
   resolved "https://registry.npmjs.org/@cloudflare/kv-asset-handler/-/kv-asset-handler-0.3.1.tgz"
@@ -1488,6 +1495,11 @@ reusify@^1.0.4:
   resolved "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz"
   integrity sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==
 
+rfc4648@^1.5.2:
+  version "1.5.3"
+  resolved "https://registry.npmjs.org/rfc4648/-/rfc4648-1.5.3.tgz"
+  integrity sha512-MjOWxM065+WswwnmNONOT+bD1nXzY9Km6u3kzvnx8F8/HXGZdz3T6e6vZJ8Q/RIMUSp/nxqjH3GwvJDy8ijeQQ==
+
 rimraf@^3.0.2:
   version "3.0.2"
   resolved "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz"