SIGN IN SIGN UP
oven-sh / bun UNCLAIMED

Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one

0 0 150 Rust

crypto: X509Certificate#checkIssued() should return a boolean (#31571)

Fixes #31570

## Problem

`X509Certificate.prototype.checkIssued(otherCert)` must return a
**boolean** in Node.js. Bun returned the issuer certificate object on
success and `undefined` on failure.

```js
import { X509Certificate } from "node:crypto";
import { readFileSync } from "node:fs";

const cert = new X509Certificate(readFileSync("ca1-cert.pem")); // self-signed
cert.checkIssued(cert);        // Node: true      | Bun (before): <the certificate>
typeof cert.checkIssued(cert); // Node: "boolean" | Bun (before): "object"
```

## Cause

`jsX509CertificateProtoFuncCheckIssued` in
`src/jsc/bindings/JSX509CertificatePrototype.cpp` copied the return
pattern from `checkHost`/`checkEmail`/`checkIP`, where returning the
validated value (or `undefined`) is the correct Node contract:

```cpp
if (!check) return JSValue::encode(jsUndefined());
return JSValue::encode(issuer);
```

But `checkIssued` returns a boolean in Node. The underlying
`JSX509Certificate::checkIssued` already returns a C++ `bool` correctly
— only the JS wrapper's return value was wrong. This has been the case
since the method was first implemented (#16173); it is not a regression.

## Fix

Return the boolean directly:

```cpp
auto check = thisObject->checkIssued(globalObject, issuer);
RETURN_IF_EXCEPTION(scope, {});
return JSValue::encode(jsBoolean(check));
```

## Verification

Added coverage in `test/js/node/crypto/x509-subclass.test.ts` (the
existing `node:crypto` X509Certificate test file) asserting `typeof ===
"boolean"` for:

- `agent1.checkIssued(ca1)` → `true` (issued by)
- `ca1.checkIssued(ca1)` → `true` (self-signed — the reported case)
- `agent1.checkIssued(ca2)` → `false` (unrelated issuer)
- `agent1.checkIssued(agent1)` → `false` (not self-signed)
- invalid argument throws `ERR_INVALID_ARG_TYPE`

The tests fail against the current release (returning
`"object"`/`"undefined"`) and pass with this change. The official
Node.js compat test `test/js/node/test/parallel/test-crypto-x509.js`
still passes.
R
robobun committed
efc26a1be0413d71d5210715ea22ce8ed485ab16
Parent: cb4a5c6
Committed by GitHub <noreply@github.com> on 5/29/2026, 5:50:16 PM