crypto: avoid throwing CryptoKey brand checks

Use the native CryptoKey FunctionTemplate brand check instead of
probing slot access and catching ERR_INVALID_THIS. Keep a private-field
fast path for ordinary same-realm CryptoKeys.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
PR-URL: #65503
Reviewed-By: Aviv Keller <me@aviv.sh>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>

Author: panva

lib/internal/crypto/keys.js

@@ -20,6 +20,7 @@ const {
   createCryptoKeyClass,
   // eslint-disable-next-line no-restricted-syntax -- intended here
   getCryptoKeySlots: nativeGetCryptoKeySlots,
+  isCryptoKey: isNativeCryptoKey,
   kKeyTypeSecret,
   kKeyTypePublic,
   kKeyTypePrivate,
@@ -1075,6 +1076,7 @@ function getKeyObjectAsymmetricKeyDetails(key) {
 // requires repeat reads to return the same object so a consumer's
 // mutation is visible next time).
 let getSlots; // Populated by the createCryptoKeyClass callback below.
+let isCryptoKey;
 
 const kSlotType = 0;
 const kSlotExtractable = 1;
@@ -1176,6 +1178,10 @@ const {
     }
 
     static {
+      isCryptoKey = (key) => {
+        if (key == null || typeof key !== 'object') return false;
+        return #slots in key || isNativeCryptoKey(key);
+      };
       getSlots = (key) => {
         if (!key || typeof key !== 'object')
           throw new ERR_INVALID_THIS('CryptoKey');
@@ -1307,18 +1313,6 @@ function getCryptoKeyHandle(key) {
   return getSlots(key)[kSlotHandle];
 }
 
-function isCryptoKey(obj) {
-  if (obj == null || typeof obj !== 'object')
-    return false;
-
-  try {
-    getSlots(obj);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
 function importGenericSecretKey(
   algorithm,
   format,

src/crypto/crypto_keys.cc

@@ -1875,12 +1875,15 @@ void NativeCryptoKey::Initialize(Environment* env, Local<Object> target) {
             NativeCryptoKey::CreateCryptoKeyClass);
   SetMethod(
       env->context(), target, "getCryptoKeySlots", NativeCryptoKey::GetSlots);
+  SetMethodNoSideEffect(
+      env->context(), target, "isCryptoKey", NativeCryptoKey::IsCryptoKey);
 }
 
 void NativeCryptoKey::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(NativeCryptoKey::CreateCryptoKeyClass);
   registry->Register(NativeCryptoKey::GetSlots);
+  registry->Register(NativeCryptoKey::IsCryptoKey);
   registry->Register(NativeCryptoKey::New);
 }
 
@@ -1897,6 +1900,12 @@ bool NativeCryptoKey::HasInstance(Environment* env, Local<Value> value) {
   return IsNativeCryptoKey(env, value);
 }
 
+void NativeCryptoKey::IsCryptoKey(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  CHECK_EQ(args.Length(), 1);
+  args.GetReturnValue().Set(HasInstance(env, args[0]));
+}
+
 MaybeLocal<Value> NativeCryptoKey::Create(Environment* env,
                                           const KeyObjectData& data,
                                           Local<Value> algorithm,

src/crypto/crypto_keys.h

@@ -278,6 +278,7 @@ class NativeCryptoKey : public BaseObject {
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void CreateCryptoKeyClass(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsCryptoKey(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   static v8::MaybeLocal<v8::Value> Create(Environment* env,
                                           const KeyObjectData& data,

typings/internalBinding/crypto.d.ts

@@ -939,6 +939,7 @@ export interface CryptoBinding {
   getExtraCACertificates(): string[];
   getFipsCrypto(): 0 | 1;
   getHashes(): string[];
+  isCryptoKey(key: unknown): boolean;
   isKeyObject(key: unknown): boolean;
   getKeyObjectSlots(key: object): InternalCryptoBinding.KeyObjectSlots;
   getOpenSSLSecLevelCrypto(): number | undefined;