Skip to content

Commit f8deaae

Browse files
ricmooricmoo
committed
Updated to latest elliptic library to fix audit warnings.
1 parent c6a1b15 commit f8deaae

14 files changed

+191
-43
lines changed

‎package-lock.json

+5-4
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json

+1-1
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@
9393
"aes-js": "3.0.0",
9494
"bech32": "1.1.4",
9595
"bn.js": "^5.2.1",
96-
"elliptic": "6.5.4",
96+
"elliptic": "6.6.1",
9797
"hash.js": "1.1.7",
9898
"js-sha3": "0.8.0",
9999
"scrypt-js": "3.0.1",

‎packages/ethers/dist/ethers.esm.js

+58-10
Original file line numberDiff line numberDiff line change
@@ -11503,12 +11503,15 @@ utils.encode = utils_1.encode;
1150311503
// Represent num in a w-NAF form
1150411504
function getNAF(num, w, bits) {
1150511505
var naf = new Array(Math.max(num.bitLength(), bits) + 1);
11506-
naf.fill(0);
11506+
var i;
11507+
for (i = 0; i < naf.length; i += 1) {
11508+
naf[i] = 0;
11509+
}
1150711510

1150811511
var ws = 1 << (w + 1);
1150911512
var k = num.clone();
1151011513

11511-
for (var i = 0; i < naf.length; i++) {
11514+
for (i = 0; i < naf.length; i++) {
1151211515
var z;
1151311516
var mod = k.andln(ws - 1);
1151411517
if (k.isOdd()) {
@@ -13405,8 +13408,8 @@ KeyPair.prototype.sign = function sign(msg, enc, options) {
1340513408
return this.ec.sign(msg, this, enc, options);
1340613409
};
1340713410

13408-
KeyPair.prototype.verify = function verify(msg, signature) {
13409-
return this.ec.verify(msg, signature, this);
13411+
KeyPair.prototype.verify = function verify(msg, signature, options) {
13412+
return this.ec.verify(msg, signature, this, undefined, options);
1341013413
};
1341113414

1341213415
KeyPair.prototype.inspect = function inspect() {
@@ -13454,6 +13457,10 @@ function getLength(buf, p) {
1345413457
return false;
1345513458
}
1345613459

13460+
if(buf[p.place] === 0x00) {
13461+
return false;
13462+
}
13463+
1345713464
var val = 0;
1345813465
for (var i = 0, off = p.place; i < octetLen; i++, off++) {
1345913466
val <<= 8;
@@ -13502,6 +13509,9 @@ Signature.prototype._importDER = function _importDER(data, enc) {
1350213509
if (rlen === false) {
1350313510
return false;
1350413511
}
13512+
if ((data[p.place] & 128) !== 0) {
13513+
return false;
13514+
}
1350513515
var r = data.slice(p.place, rlen + p.place);
1350613516
p.place += rlen;
1350713517
if (data[p.place++] !== 0x02) {
@@ -13514,6 +13524,9 @@ Signature.prototype._importDER = function _importDER(data, enc) {
1351413524
if (data.length !== slen + p.place) {
1351513525
return false;
1351613526
}
13527+
if ((data[p.place] & 128) !== 0) {
13528+
return false;
13529+
}
1351713530
var s = data.slice(p.place, slen + p.place);
1351813531
if (r[0] === 0) {
1351913532
if (r[1] & 0x80) {
@@ -13661,8 +13674,27 @@ EC.prototype.genKeyPair = function genKeyPair(options) {
1366113674
}
1366213675
};
1366313676

13664-
EC.prototype._truncateToN = function _truncateToN(msg, truncOnly) {
13665-
var delta = msg.byteLength() * 8 - this.n.bitLength();
13677+
EC.prototype._truncateToN = function _truncateToN(msg, truncOnly, bitLength) {
13678+
var byteLength;
13679+
if (bn.isBN(msg) || typeof msg === 'number') {
13680+
msg = new bn(msg, 16);
13681+
byteLength = msg.byteLength();
13682+
} else if (typeof msg === 'object') {
13683+
// BN assumes an array-like input and asserts length
13684+
byteLength = msg.length;
13685+
msg = new bn(msg, 16);
13686+
} else {
13687+
// BN converts the value to string
13688+
var str = msg.toString();
13689+
// HEX encoding
13690+
byteLength = (str.length + 1) >>> 1;
13691+
msg = new bn(str, 16);
13692+
}
13693+
// Allow overriding
13694+
if (typeof bitLength !== 'number') {
13695+
bitLength = byteLength * 8;
13696+
}
13697+
var delta = bitLength - this.n.bitLength();
1366613698
if (delta > 0)
1366713699
msg = msg.ushrn(delta);
1366813700
if (!truncOnly && msg.cmp(this.n) >= 0)
@@ -13679,8 +13711,18 @@ EC.prototype.sign = function sign(msg, key, enc, options) {
1367913711
if (!options)
1368013712
options = {};
1368113713

13714+
if (typeof msg !== 'string' && typeof msg !== 'number' && !bn.isBN(msg)) {
13715+
assert$5(typeof msg === 'object' && msg && typeof msg.length === 'number',
13716+
'Expected message to be an array-like, a hex string, or a BN instance');
13717+
assert$5((msg.length >>> 0) === msg.length); // non-negative 32-bit integer
13718+
for (var i = 0; i < msg.length; i++) assert$5((msg[i] & 255) === msg[i]);
13719+
}
13720+
1368213721
key = this.keyFromPrivate(key, enc);
13683-
msg = this._truncateToN(new bn(msg, 16));
13722+
msg = this._truncateToN(msg, false, options.msgBitLength);
13723+
13724+
// Would fail further checks, but let's make the error message clear
13725+
assert$5(!msg.isNeg(), 'Can not sign a negative message');
1368413726

1368513727
// Zero-extend key to provide enough entropy
1368613728
var bytes = this.n.byteLength();
@@ -13689,6 +13731,9 @@ EC.prototype.sign = function sign(msg, key, enc, options) {
1368913731
// Zero-extend nonce to have the same byte size as N
1369013732
var nonce = msg.toArray('be', bytes);
1369113733

13734+
// Recheck nonce to be bijective to msg
13735+
assert$5((new bn(nonce)).eq(msg), 'Can not sign message');
13736+
1369213737
// Instantiate Hmac_DRBG
1369313738
var drbg = new hmacDrbg({
1369413739
hash: this.hash,
@@ -13736,8 +13781,11 @@ EC.prototype.sign = function sign(msg, key, enc, options) {
1373613781
}
1373713782
};
1373813783

13739-
EC.prototype.verify = function verify(msg, signature$1, key, enc) {
13740-
msg = this._truncateToN(new bn(msg, 16));
13784+
EC.prototype.verify = function verify(msg, signature$1, key, enc, options) {
13785+
if (!options)
13786+
options = {};
13787+
13788+
msg = this._truncateToN(msg, false, options.msgBitLength);
1374113789
key = this.keyFromPublic(key, enc);
1374213790
signature$1 = new signature(signature$1, 'hex');
1374313791

@@ -13830,7 +13878,7 @@ var elliptic_1 = createCommonjsModule$1(function (module, exports) {
1383013878

1383113879
var elliptic = exports;
1383213880

13833-
elliptic.version = /*RicMoo:ethers*/{ version: "6.5.4" }.version;
13881+
elliptic.version = /*RicMoo:ethers*/{ version: "6.6.1" }.version;
1383413882
elliptic.utils = utils_1$1;
1383513883
elliptic.rand = /*RicMoo:ethers:require(brorand)*/(function() { throw new Error('unsupported'); });
1383613884
elliptic.curve = curve_1;

‎packages/ethers/dist/ethers.esm.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/ethers/dist/ethers.esm.min.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/ethers/dist/ethers.esm.min.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/ethers/dist/ethers.umd.js

+58-10
Original file line numberDiff line numberDiff line change
@@ -14904,12 +14904,15 @@
1490414904
// Represent num in a w-NAF form
1490514905
function getNAF(num, w, bits) {
1490614906
var naf = new Array(Math.max(num.bitLength(), bits) + 1);
14907-
naf.fill(0);
14907+
var i;
14908+
for (i = 0; i < naf.length; i += 1) {
14909+
naf[i] = 0;
14910+
}
1490814911

1490914912
var ws = 1 << (w + 1);
1491014913
var k = num.clone();
1491114914

14912-
for (var i = 0; i < naf.length; i++) {
14915+
for (i = 0; i < naf.length; i++) {
1491314916
var z;
1491414917
var mod = k.andln(ws - 1);
1491514918
if (k.isOdd()) {
@@ -18083,8 +18086,8 @@
1808318086
return this.ec.sign(msg, this, enc, options);
1808418087
};
1808518088

18086-
KeyPair.prototype.verify = function verify(msg, signature) {
18087-
return this.ec.verify(msg, signature, this);
18089+
KeyPair.prototype.verify = function verify(msg, signature, options) {
18090+
return this.ec.verify(msg, signature, this, undefined, options);
1808818091
};
1808918092

1809018093
KeyPair.prototype.inspect = function inspect() {
@@ -18132,6 +18135,10 @@
1813218135
return false;
1813318136
}
1813418137

18138+
if(buf[p.place] === 0x00) {
18139+
return false;
18140+
}
18141+
1813518142
var val = 0;
1813618143
for (var i = 0, off = p.place; i < octetLen; i++, off++) {
1813718144
val <<= 8;
@@ -18180,6 +18187,9 @@
1818018187
if (rlen === false) {
1818118188
return false;
1818218189
}
18190+
if ((data[p.place] & 128) !== 0) {
18191+
return false;
18192+
}
1818318193
var r = data.slice(p.place, rlen + p.place);
1818418194
p.place += rlen;
1818518195
if (data[p.place++] !== 0x02) {
@@ -18192,6 +18202,9 @@
1819218202
if (data.length !== slen + p.place) {
1819318203
return false;
1819418204
}
18205+
if ((data[p.place] & 128) !== 0) {
18206+
return false;
18207+
}
1819518208
var s = data.slice(p.place, slen + p.place);
1819618209
if (r[0] === 0) {
1819718210
if (r[1] & 0x80) {
@@ -18339,8 +18352,27 @@
1833918352
}
1834018353
};
1834118354

18342-
EC.prototype._truncateToN = function _truncateToN(msg, truncOnly) {
18343-
var delta = msg.byteLength() * 8 - this.n.bitLength();
18355+
EC.prototype._truncateToN = function _truncateToN(msg, truncOnly, bitLength) {
18356+
var byteLength;
18357+
if (bn$1.isBN(msg) || typeof msg === 'number') {
18358+
msg = new bn$1(msg, 16);
18359+
byteLength = msg.byteLength();
18360+
} else if (typeof msg === 'object') {
18361+
// BN assumes an array-like input and asserts length
18362+
byteLength = msg.length;
18363+
msg = new bn$1(msg, 16);
18364+
} else {
18365+
// BN converts the value to string
18366+
var str = msg.toString();
18367+
// HEX encoding
18368+
byteLength = (str.length + 1) >>> 1;
18369+
msg = new bn$1(str, 16);
18370+
}
18371+
// Allow overriding
18372+
if (typeof bitLength !== 'number') {
18373+
bitLength = byteLength * 8;
18374+
}
18375+
var delta = bitLength - this.n.bitLength();
1834418376
if (delta > 0)
1834518377
msg = msg.ushrn(delta);
1834618378
if (!truncOnly && msg.cmp(this.n) >= 0)
@@ -18357,8 +18389,18 @@
1835718389
if (!options)
1835818390
options = {};
1835918391

18392+
if (typeof msg !== 'string' && typeof msg !== 'number' && !bn$1.isBN(msg)) {
18393+
assert$5(typeof msg === 'object' && msg && typeof msg.length === 'number',
18394+
'Expected message to be an array-like, a hex string, or a BN instance');
18395+
assert$5((msg.length >>> 0) === msg.length); // non-negative 32-bit integer
18396+
for (var i = 0; i < msg.length; i++) assert$5((msg[i] & 255) === msg[i]);
18397+
}
18398+
1836018399
key = this.keyFromPrivate(key, enc);
18361-
msg = this._truncateToN(new bn$1(msg, 16));
18400+
msg = this._truncateToN(msg, false, options.msgBitLength);
18401+
18402+
// Would fail further checks, but let's make the error message clear
18403+
assert$5(!msg.isNeg(), 'Can not sign a negative message');
1836218404

1836318405
// Zero-extend key to provide enough entropy
1836418406
var bytes = this.n.byteLength();
@@ -18367,6 +18409,9 @@
1836718409
// Zero-extend nonce to have the same byte size as N
1836818410
var nonce = msg.toArray('be', bytes);
1836918411

18412+
// Recheck nonce to be bijective to msg
18413+
assert$5((new bn$1(nonce)).eq(msg), 'Can not sign message');
18414+
1837018415
// Instantiate Hmac_DRBG
1837118416
var drbg = new hmacDrbg({
1837218417
hash: this.hash,
@@ -18414,8 +18459,11 @@
1841418459
}
1841518460
};
1841618461

18417-
EC.prototype.verify = function verify(msg, signature$1, key, enc) {
18418-
msg = this._truncateToN(new bn$1(msg, 16));
18462+
EC.prototype.verify = function verify(msg, signature$1, key, enc, options) {
18463+
if (!options)
18464+
options = {};
18465+
18466+
msg = this._truncateToN(msg, false, options.msgBitLength);
1841918467
key = this.keyFromPublic(key, enc);
1842018468
signature$1 = new signature(signature$1, 'hex');
1842118469

@@ -18508,7 +18556,7 @@
1850818556

1850918557
var elliptic = exports;
1851018558

18511-
elliptic.version = /*RicMoo:ethers*/{ version: "6.5.4" }.version;
18559+
elliptic.version = /*RicMoo:ethers*/{ version: "6.6.1" }.version;
1851218560
elliptic.utils = utils_1$1;
1851318561
elliptic.rand = /*RicMoo:ethers:require(brorand)*/(function() { throw new Error('unsupported'); });
1851418562
elliptic.curve = curve_1;

‎packages/ethers/dist/ethers.umd.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/ethers/dist/ethers.umd.min.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/ethers/dist/ethers.umd.min.js.map

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/ethers/package.json

+3
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,9 @@
5252
"license": "MIT",
5353
"main": "./lib/index.js",
5454
"module": "./lib.esm/index.js",
55+
"publishConfig": {
56+
"tag": "legacy-v5"
57+
},
5558
"name": "ethers",
5659
"repository": {
5760
"directory": "packages/ethers",

0 commit comments

Comments
 (0)