Variant

worldmonitor.app (Full / Geopolitical)

Affected area

Other

Bug description

The _crypto.js module assumes certain inputs are valid without performing type validation.

Specifically:

• Some code paths assume an input is always an array and use array operations without checking the value.
• Some cryptographic operations assume keys are strings and do not validate their type before use.

Passing unexpected input types (such as null, undefined, objects, numbers, or booleans) can result in uncaught runtime exceptions instead of a controlled failure. This may cause authentication failures or API key verification to terminate unexpectedly.

The module should validate inputs before performing cryptographic operations and gracefully reject invalid values without throwing uncaught exceptions.

Steps to reproduce

1. Locate a code path that invokes the affected _crypto.js functions.
2. Pass a non-array value (for example: null, undefined, {}, or "abc") where an array is expected.
3. Pass a non-string value (for example: null, {}, 123, true, or []) as the cryptographic key.
4. Execute the function.
5. Observe that a runtime exception is thrown instead of the input being rejected gracefully.

Expected behavior

Invalid input should be validated before any cryptographic operations are performed.

• Non-array inputs should be rejected or handled gracefully.
• Non-string keys should be rejected before being passed to cryptographic APIs.
• The module should return its normal failure behavior (such as an authentication failure) rather than throwing an uncaught exception.
• Existing behavior for valid inputs should remain unchanged.

Screenshots / Console errors

N/A

The issue was identified through code inspection. A runtime TypeError or similar exception is expected when invalid input types reach the affected code paths.

Browser & OS

N/A (Backend / Node.js environment)