crypto: make DEP0206 end-of-life

lib/internal/crypto/hash.js

@@ -40,13 +40,8 @@ const {
   lazyDOMException,
   normalizeEncoding,
   encodingsMap,
-  getDeprecationWarningEmitter,
 } = require('internal/util');
 
-const {
-  Buffer,
-} = require('buffer');
-
 const {
   codes: {
     ERR_CRYPTO_HASH_FINALIZED,
@@ -72,11 +67,6 @@ const LazyTransform = require('internal/streams/lazy_transform');
 const kState = Symbol('kState');
 const kFinalized = Symbol('kFinalized');
 
-const emitHmacDigestDeprecation = getDeprecationWarningEmitter(
-  'DEP0206',
-  'Calling Hmac.digest() more than once is deprecated.',
-);
-
 function Hash(algorithm, options) {
   if (!new.target)
     return new Hash(algorithm, options);
@@ -173,21 +163,20 @@ Hmac.prototype.update = Hash.prototype.update;
 Hmac.prototype.digest = function digest(outputEncoding) {
   const state = this[kState];
 
-  if (state[kFinalized]) {
-    emitHmacDigestDeprecation();
-    const buf = Buffer.from('');
-    if (outputEncoding && outputEncoding !== 'buffer')
-      return buf.toString(outputEncoding);
-    return buf;
-  }
+  if (state[kFinalized])
+    throw new ERR_CRYPTO_HASH_FINALIZED();
 
   // Explicit conversion of truthy values for backward compatibility.
   const ret = this[kHandle].digest(outputEncoding && `${outputEncoding}`);
   state[kFinalized] = true;
   return ret;
 };
 
-Hmac.prototype._flush = Hash.prototype._flush;
+Hmac.prototype._flush = function _flush(callback) {
+  this.push(this[kHandle].digest());
+  this[kState][kFinalized] = true;
+  callback();
+};
 Hmac.prototype._transform = Hash.prototype._transform;
 
 // Implementation for WebCrypto subtle.digest()

src/crypto/crypto_hmac.cc

@@ -141,6 +141,9 @@ void Hmac::HmacDigest(const FunctionCallbackInfo<Value>& args) {
       return ThrowCryptoError(env, ERR_get_error(), "Failed to finalize HMAC");
     }
     hmac->ctx_.reset();
+  } else {
+    // The context has already been finalized; never emit unwritten bytes.
+    buf.len = 0;
   }
 
   Local<Value> ret;

test/parallel/test-crypto-hmac-finalized.js

@@ -0,0 +1,34 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const crypto = require('crypto');
+
+// DEP0206 reached end-of-life: calling Hmac.digest() on a finalized instance
+// now throws ERR_CRYPTO_HASH_FINALIZED instead of returning an empty buffer.
+// See: https://github.com/nodejs/node/pull/65112
+
+// Repeated digest() on the same instance throws.
+{
+  const h = crypto.createHmac('sha1', 'key').update('data');
+  assert.strictEqual(h.digest('hex').length, 40);
+  assert.throws(() => h.digest('hex'), { code: 'ERR_CRYPTO_HASH_FINALIZED' });
+}
+
+// digest() with no data throws on a second call.
+{
+  const h = crypto.createHmac('sha1', 'key');
+  assert.strictEqual(h.digest('buffer').length, 20);
+  assert.throws(() => h.digest('buffer'), { code: 'ERR_CRYPTO_HASH_FINALIZED' });
+}
+
+// digest() after the Hmac has been used as a stream throws.
+{
+  const h = crypto.createHmac('sha1', 'key');
+  h.end('data');
+  assert.strictEqual(h.read().length, 20);
+  assert.throws(() => h.digest('buffer'), { code: 'ERR_CRYPTO_HASH_FINALIZED' });
+}

test/parallel/test-crypto-hmac.js

@@ -296,6 +296,27 @@ for (let i = 0, l = rfc4231.length; i < l; i++) {
   }
 }
 
+// Calling digest() after the Hmac has already been used as a stream must
+// throw ERR_CRYPTO_HASH_FINALIZED (the DEP0206 end-of-life behavior), not
+// return uninitialized stack memory. The stream itself must still produce the
+// correct digest.
+// See: https://github.com/nodejs/node/issues/28245
+{
+  const key = 'key';
+  const data = 'some data to hash';
+
+  const streamHmac = crypto.createHmac('sha256', key);
+  streamHmac.end(data);
+  const streamDigest = streamHmac.read();
+
+  // digest() after the stream already finalized must not return garbage.
+  assert.throws(() => streamHmac.digest(), { code: 'ERR_CRYPTO_HASH_FINALIZED' });
+
+  // Sanity check: the stream itself produced the correct digest.
+  const expected = crypto.createHmac('sha256', key).update(data).digest();
+  assert.deepStrictEqual(streamDigest, expected);
+}
+
 // Test HMAC-MD5/SHA1 (rfc 2202 Test Cases)
 const rfc2202_md5 = [
   {