crypto.createDecipheriv for aes-128-cbc does not regard setAutoPadding == false

[chrisbald]

Version

v22.11.0

Platform

Microsoft Windows NT 10.0.19045.0 x64

Subsystem

No response

What steps will reproduce the bug?

import crypto from 'crypto';

const key = Buffer.from('a907507c8b1cf3c0bb2bc1cec426cf69', 'hex');
const iv  = Buffer.from('8c5821332e6f1cf089dbb78c380c9248', 'hex');
const encryptedData = Buffer.from('a9e727b3658f252faeaf5d125a95c1c299fe6532c103b56fe633423bb78a25cb8f66e930aaacc40f04c3ae94183cbfbeb09ab9c952f97d8a5ea055ed304aac07', 'hex');

const decipher = crypto.createDecipheriv('aes-128-cbc', key, iv);
decipher.setAutoPadding = false;

const dec_1 = decipher.update(encryptedData);
const dec_2 = decipher.final();

console.log(`Input length: ${encryptedData.length}; Output length: ${dec_1.length + dec_2.length}`);

console.log('Expected: 4CAD87E30752820F213E64F9492167456D5F02C4518D4BB7ADF291A7F8EAC6FEB352781CF8AD7DF0DEC19B06B6DE98BA92A0FD3BAE72B448520D6E5807153901');
console.log('Result:   ' + dec_1.toString('hex').toUpperCase() + dec_2.toString('hex').toUpperCase());

How often does it reproduce? Is there a required condition?

always

What is the expected behavior? Why is that the expected behavior?

With decipher.setAutoPadding = false; it should be possible to disable padding.
It is expected that the decrypted block in the example does have the same length than the input block.

What do you see instead?

The decrypted block misses 1 byte (0x01) at the end.

Additional information

No response

[StefanStojanovic]

I've removed the windows label since the same issue appears when running that code on Linux. Added 'crypto` instead. This is the output I got on Linux:

Input length: 64; Output length: 63
Expected: 4CAD87E30752820F213E64F9492167456D5F02C4518D4BB7ADF291A7F8EAC6FEB352781CF8AD7DF0DEC19B06B6DE98BA92A0FD3BAE72B448520D6E5807153901
Result:   4CAD87E30752820F213E64F9492167456D5F02C4518D4BB7ADF291A7F8EAC6FEB352781CF8AD7DF0DEC19B06B6DE98BA92A0FD3BAE72B448520D6E58071539

[tniessen]

This is expected. You are not actually calling setAutoPadding(false) but overwriting the function-valued property with the constant false, which has no documented effect. If you actually call setAutoPadding(false) instead, you should be able to disable padding.

[chrisbald]

Yep, that was my fault.
Sorry for the trouble and thanks for the clarification.

[tniessen]

No worries, JavaScript is a horrible language and unfortunately permits this kind of mistake way too easily.