@metamask/key-tree - npm Package Compare versions

Comparing version 2.0.0 to 2.0.1

CHANGELOG.md

@@ -10,2 +10,9 @@ # Changelog
 
+## [2.0.1] - 2021-02-27
+
+### Fixed
+
+- Correctly type `deriveKeyFromPath` `parentKey` param as optional ([#14](https://github.com/MetaMask/key-tree/pull/14))
+- Only accept lowercase BIP-39 seed phrases in `deriveKeyFromPath` ([#15](https://github.com/MetaMask/key-tree/pull/15))
+
 ## [2.0.0] - 2021-02-25
@@ -12,0 +19,0 @@

dist/derivers/bip32.d.ts

 /// <reference types="node" />
 export declare function privateKeyToEthAddress(keyBuffer: Buffer): Buffer;
 export declare function bip32PathToMultipath(bip32Path: string): string;
-export declare function deriveChildKey(parentKey: Buffer, pathPart: string): Buffer;
+export declare function deriveChildKey(pathPart: string, parentKey: Buffer): Buffer;

dist/derivers/bip32.js

@@ -33,3 +33,3 @@ "use strict";
 exports.bip32PathToMultipath = bip32PathToMultipath;
-function deriveChildKey(parentKey, pathPart) {
+function deriveChildKey(pathPart, parentKey) {
     const isHardened = pathPart.includes(`'`);
@@ -39,2 +39,3 @@ const indexPart = pathPart.split(`'`)[0];
     assert_1.default(childIndex < HARDENED_OFFSET, 'Invalid index');
+    assert_1.default(Boolean(parentKey), 'Must provide parentKey');
     assert_1.default(parentKey.length === 64, 'Parent key invalid length');
@@ -41,0 +42,0 @@ const parentPrivateKey = parentKey.slice(0, 32);

dist/derivers/bip39.d.ts

 /// <reference types="node" />
 export declare function bip39MnemonicToMultipath(mnemonic: string): string;
-export declare function deriveChildKey(_parentKey: unknown, pathPart: string): Buffer;
+export declare function deriveChildKey(pathPart: string, _parentKey?: never): Buffer;

dist/derivers/bip39.js

@@ -11,7 +11,7 @@ "use strict";
 function bip39MnemonicToMultipath(mnemonic) {
-    return `bip39:${mnemonic.trim()}`;
+    return `bip39:${mnemonic.toLowerCase().trim()}`;
 }
 exports.bip39MnemonicToMultipath = bip39MnemonicToMultipath;
 // this creates a child key using bip39, ignoring the parent key
-function deriveChildKey(_parentKey, pathPart) {
+function deriveChildKey(pathPart, _parentKey) {
     const mnemonic = pathPart;
@@ -18,0 +18,0 @@ const seedBuffer = bip39_1.default.mnemonicToSeed(mnemonic);

dist/derivers/index.d.ts

@@ -0,7 +1,10 @@
+/// <reference types="node" />
 import * as bip32 from './bip32';
 import * as bip39 from './bip39';
-declare const _default: {
+export interface Deriver {
+    deriveChildKey: (pathPart: string, parentKey?: Buffer) => Buffer;
+}
+export declare const derivers: {
     bip32: typeof bip32;
     bip39: typeof bip39;
 };
-export = _default;

dist/derivers/index.js

@@ -21,5 +21,7 @@ "use strict";
 };
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.derivers = void 0;
 const bip32 = __importStar(require("./bip32"));
 const bip39 = __importStar(require("./bip39"));
-module.exports = {
+exports.derivers = {
     bip32,
@@ -26,0 +28,0 @@ bip39,

dist/index.d.ts

 /// <reference types="node" />
+/**
+ * Converts the given BIP-39 mnemonic to a cryptographic seed.
+ * @param mnemonic - The BIP-39 mnemonic.
+ * @returns The cryptographic seed corresponding to the given mnemonic.
+ */
 export declare function mnemonicToSeed(mnemonic: string): Buffer;
@@ -15,6 +20,21 @@ /**
 /**
- * @param {string} pathSegment - A full or leaf HD path segment. If full,
- * optionally preceded by "bip39:<SPACE_DELIMITED_SEED_PHRASE>/".
- * @param {Buffer} [parentKey] - The parent key of the given path segment.
+ * Takes a full or partial HD path string and returns the key corresponding to
+ * the given path, with the following constraints:
+ *
+ * - If the path starts with a BIP-32 segment, a parent key must be provided.
+ * - If the path starts with a BIP-39 segment, a parent key may NOT be provided.
+ * - The path cannot exceed 5 BIP-32 segments in length, optionally preceded by
+ *   a single BIP-39 segment.
+ *
+ * WARNING: It is the consumer's responsibility to ensure that the path is valid
+ * relative to its parent key.
+ *
+ * @param pathSegment - A full or partial HD path, e.g.:
+ * bip39:SEED_PHRASE/bip32:44'/bip32:60'/bip32:0'/bip32:0/bip32:0
+ *
+ * BIP-39 seed phrases must be lowercase, space-delimited, and 12-24 words long.
+ *
+ * @param parentKey - The parent key of the given path segment, if any.
+ * @returns The derived key.
  */
-export declare function deriveKeyFromPath(pathSegment: string, parentKey: Buffer): Buffer;
+export declare function deriveKeyFromPath(pathSegment: string, parentKey?: Buffer): Buffer;

dist/index.js

@@ -8,3 +8,8 @@ "use strict";
 const bip39_1 = __importDefault(require("bip39"));
-const derivers_1 = __importDefault(require("./derivers"));
+const derivers_1 = require("./derivers");
+/**
+ * Converts the given BIP-39 mnemonic to a cryptographic seed.
+ * @param mnemonic - The BIP-39 mnemonic.
+ * @returns The cryptographic seed corresponding to the given mnemonic.
+ */
 function mnemonicToSeed(mnemonic) {
@@ -26,5 +31,20 @@ return bip39_1.default.mnemonicToSeed(mnemonic);
 /**
- * @param {string} pathSegment - A full or leaf HD path segment. If full,
- * optionally preceded by "bip39:<SPACE_DELIMITED_SEED_PHRASE>/".
- * @param {Buffer} [parentKey] - The parent key of the given path segment.
+ * Takes a full or partial HD path string and returns the key corresponding to
+ * the given path, with the following constraints:
+ *
+ * - If the path starts with a BIP-32 segment, a parent key must be provided.
+ * - If the path starts with a BIP-39 segment, a parent key may NOT be provided.
+ * - The path cannot exceed 5 BIP-32 segments in length, optionally preceded by
+ *   a single BIP-39 segment.
+ *
+ * WARNING: It is the consumer's responsibility to ensure that the path is valid
+ * relative to its parent key.
+ *
+ * @param pathSegment - A full or partial HD path, e.g.:
+ * bip39:SEED_PHRASE/bip32:44'/bip32:60'/bip32:0'/bip32:0/bip32:0
+ *
+ * BIP-39 seed phrases must be lowercase, space-delimited, and 12-24 words long.
+ *
+ * @param parentKey - The parent key of the given path segment, if any.
+ * @returns The derived key.
  */
@@ -40,4 +60,4 @@ function deriveKeyFromPath(pathSegment, parentKey) {
         }
-        const deriver = derivers_1.default[pathType];
-        const childKey = deriver.deriveChildKey(key, pathValue);
+        const deriver = derivers_1.derivers[pathType];
+        const childKey = deriver.deriveChildKey(pathValue, key);
         // continue deriving from child key
@@ -50,3 +70,3 @@ key = childKey;
 function hasDeriver(pathType) {
-    return pathType in derivers_1.default;
+    return pathType in derivers_1.derivers;
 }
@@ -64,3 +84,3 @@ /**
  */
-const BIP_39_PATH_REGEX = /^bip39:(\w+){1}( \w+){11,23}$/u;
+const BIP_39_PATH_REGEX = /^bip39:([a-z]+){1}( [a-z]+){11,23}$/u;
 /**
@@ -71,3 +91,3 @@ * e.g.
  */
-const MULTI_PATH_REGEX = /^(bip39:(\w+){1}( \w+){11,23}\/)?(bip32:\d+'?\/){0,4}(bip32:\d+'?)$/u;
+const MULTI_PATH_REGEX = /^(bip39:([a-z]+){1}( [a-z]+){11,23}\/)?(bip32:\d+'?\/){0,4}(bip32:\d+'?)$/u;
 function validateDeriveKeyParams(pathSegment, parentKey) {
@@ -74,0 +94,0 @@ // The path segment must be one of the following:

package.json

 {
   "name": "@metamask/key-tree",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "An interface over BIP-32 and BIP-39 key derivation paths.",
@@ -14,3 +14,4 @@ "main": "dist/index.js",
     "test": "yarn build && node ./test/index.js",
-    "test:nobuild": "node ./test/index.js"
+    "test:nobuild": "node ./test/index.js",
+    "prepublishOnly": "yarn lint && yarn test"
   },
@@ -17,0 +18,0 @@ "author": "kumavis",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

22569

increased by11.53%

Lines of code

288

increased by19.01%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes