@chainsafe/ssz - npm Package Compare versions

Comparing version 0.8.19 to 0.8.20

CHANGELOG.md

@@ -6,2 +6,5 @@ # Change Log
 
+## 0.8.20 (2021-11-23)
+- Harden ssz implementation [#211](https://github.com/ChainSafe/ssz/pull/211)
+
 ## [0.8.19](https://github.com/chainsafe/ssz/compare/@chainsafe/ssz@0.8.18...@chainsafe/ssz@0.8.19) (2021-10-12)
@@ -11,6 +14,2 @@
 
-
-
-
-
 ## 0.8.18 (2021-09-25)
@@ -17,0 +16,0 @@

lib/interface.d.ts

@@ -13,6 +13,7 @@ /**
     push(...values: T[]): number;
-    pop(): T;
+    pop(): T | undefined;
 }
 export declare type Container<T extends Record<string, unknown>> = T;
 export declare type ByteVector = Vector<number>;
+export declare type ByteList = List<number>;
 export declare type BitVector = Vector<boolean>;
@@ -19,0 +20,0 @@ export declare type BitList = List<boolean>;

lib/types/basic/uint.d.ts

@@ -0,5 +1,5 @@
+import { HashObject } from "@chainsafe/as-sha256";
 import { Json } from "../../interface";
 import { Type } from "../type";
 import { BasicType } from "./abstract";
-import { HashObject } from "@chainsafe/as-sha256";
 export interface IUintOptions {
@@ -16,2 +16,6 @@ byteLength: number;
     struct_getSerializedLength(): number;
+    /**
+     * Validate the exact byte length
+     */
+    bytes_validate_length(data: Uint8Array, start: number, end: number): void;
 }
@@ -29,3 +33,3 @@ export declare const NUMBER_UINT_TYPE: unique symbol;
     struct_serializeToBytes(value: number, output: Uint8Array, offset: number): number;
-    struct_deserializeFromBytes(data: Uint8Array, offset: number): number;
+    struct_deserializeFromBytes(data: Uint8Array, start: number, end?: number): number;
     struct_convertFromJson(data: Json): number;
@@ -54,3 +58,3 @@ struct_convertToJson(value: number): Json;
     struct_serializeToBytes(value: bigint, output: Uint8Array, offset: number): number;
-    struct_deserializeFromBytes(data: Uint8Array, offset: number): bigint;
+    struct_deserializeFromBytes(data: Uint8Array, start: number, end?: number): bigint;
     struct_convertFromJson(data: Json): bigint;
@@ -57,0 +61,0 @@ struct_convertToJson(value: bigint): Json;

lib/types/basic/uint.js

@@ -23,2 +23,14 @@ "use strict";
     }
+    /**
+     * Validate the exact byte length
+     */
+    bytes_validate_length(data, start, end) {
+        this.bytes_validate(data, start);
+        if (end !== undefined) {
+            const length = end - start;
+            if (length > this.struct_getSerializedLength()) {
+                throw new Error(`Data length of ${length} is too big, expect ${this.struct_getSerializedLength()}`);
+            }
+        }
+    }
 }
@@ -77,9 +89,15 @@ exports.UintType = UintType;
     }
-    struct_deserializeFromBytes(data, offset) {
-        this.bytes_validate(data, offset);
+    struct_deserializeFromBytes(data, start, end) {
+        // if this is a standalone deserialization, we want to validate more strictly
+        if (end !== undefined) {
+            this.bytes_validate_length(data, start, end);
+        }
+        else {
+            this.bytes_validate(data, start);
+        }
         let isInfinity = true;
         let output = 0;
         for (let i = 0; i < this.byteLength; i++) {
-            output += data[offset + i] * 2 ** (8 * i);
-            if (data[offset + i] !== 0xff) {
+            output += data[start + i] * 2 ** (8 * i);
+            if (data[start + i] !== 0xff) {
                 isInfinity = false;
@@ -250,4 +268,9 @@ }
     }
-    struct_deserializeFromBytes(data, offset) {
-        this.bytes_validate(data, offset);
+    struct_deserializeFromBytes(data, start, end) {
+        if (end !== undefined) {
+            this.bytes_validate_length(data, start, end);
+        }
+        else {
+            this.bytes_validate(data, start);
+        }
         // Motivation:
@@ -264,3 +287,3 @@ //   Creating BigInts and bitshifting is more expensive than
         for (let i = 0; i < this.byteLength; i++) {
-            groupOutput += data[offset + i] << (8 * (i % 4));
+            groupOutput += data[start + i] << (8 * (i % 4));
             if ((i + 1) % 4 === 0) {
@@ -267,0 +290,0 @@ // Left shift returns a signed integer and the output may have become negative

lib/types/composite/bitList.js

@@ -44,3 +44,3 @@ "use strict";
     getMaxSerializedLength() {
-        return Math.ceil(this.limit / 8) + 1;
+        return Math.ceil((this.limit + 1) / 8);
     }
@@ -47,0 +47,0 @@ getMinSerializedLength() {

lib/types/composite/index.d.ts

@@ -5,2 +5,3 @@ export * from "./abstract";
 export * from "./bitVector";
+export * from "./byteList";
 export * from "./byteVector";
@@ -7,0 +8,0 @@ export * from "./container";

lib/types/composite/index.js

@@ -17,2 +17,3 @@ "use strict";
 __exportStar(require("./bitVector"), exports);
+__exportStar(require("./byteList"), exports);
 __exportStar(require("./byteVector"), exports);
@@ -19,0 +20,0 @@ __exportStar(require("./container"), exports);

lib/types/composite/list.js

@@ -61,5 +61,10 @@ "use strict";
         super.bytes_validate(data, start, end, true);
-        if (end - start > this.getMaxSerializedLength()) {
-            throw new Error("Deserialized list length greater than limit");
+        const length = end - start;
+        if (length > this.getMaxSerializedLength()) {
+            throw new Error(`Deserialized list length of ${length} is greater than limit ${this.getMaxSerializedLength()}`);
         }
+        // make sure we can consume all of the data, or the generic spec test ComplexTestStruct_offset_7_plus_one failed
+        if (length % this.elementType.getFixedSerializedLength() !== 0) {
+            throw new Error(`Cannot consume ${length} bytes, element length ${this.elementType.getFixedSerializedLength()}`);
+        }
     }
@@ -66,0 +71,0 @@ struct_deserializeFromBytes(data, start, end) {

package.json

@@ -7,3 +7,3 @@ {
   "homepage": "https://github.com/chainsafe/ssz",
-  "version": "0.8.19",
+  "version": "0.8.20",
   "main": "lib/index.js",
@@ -54,3 +54,3 @@ "files": [
   ],
-  "gitHead": "e677b6b34f3eaa75de08b209440afc1e16b3dcd2"
+  "gitHead": "1f23ceb84a2f1480ecfcf683098061c8ebd8a422"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

419455

increased by1.89%

Number of package files

130

increased by2.36%

Lines of code

6261

increased by1.8%

No dependency changes