[haskou]

Motivation

• Close a canonicalization vulnerability where Media converted Buffer input to UTF-8 strings and later reconstructed bytes with Buffer.from(this.value), causing distinct binary sequences to collide during hash/sign operations.
• Preserve cryptographic integrity by ensuring crypto and hash operations consume the original raw bytes when Media is provided.

Description

• Treat Media payloads as raw bytes by using Media.getBuffer() instead of valueOf() when building message buffers for signing, verification, and encryption in PrivateKey and PublicKey. (src/value-objects/crypto/PrivateKey.ts, src/value-objects/crypto/PublicKey.ts).
• Update hash factory methods to hash Media.getBuffer() when a Media instance is passed to MD5Hash.from, SHA256Hash.from, and SHA512Hash.from so digests reflect original bytes. (src/value-objects/hashes/MD5Hash.ts, src/value-objects/hashes/SHA256Hash.ts, src/value-objects/hashes/SHA512Hash.ts).
• Preserve existing behavior for string, StringValueObject, and Buffer payloads; change affects only Media inputs.

Testing

• Ran the full test suite with npm test -- --runInBand, which completed successfully and reported all test suites passing.
• Linting and unit tests executed as part of the test run and passed (project test run shows all suites and tests passing).

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 682456077e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[haskou]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[haskou]

Superseded by #10, which uses the fix/* release branch prefix and a squash-merge-ready conventional commit title with gitmoji.