bcrypt - npm Package Compare versions

Comparing version 1.0.3 to 1.1.0-napi

bcrypt.js

@@ -30,2 +30,4 @@ 'use strict';
 module.exports.genSalt = function genSalt(rounds, ignore, cb) {
+    var error;
+
     // if callback is first argument, then use defaults for others
@@ -51,4 +53,5 @@ if (typeof arguments[0] === 'function') {
         // callback error asynchronously
+        error = new Error('rounds must be a number');
         return process.nextTick(function() {
-            cb(new Error('rounds must be a number'));
+            cb(error);
         });
@@ -92,5 +95,8 @@ }
 module.exports.hash = function hash(data, salt, cb) {
+    var error;
+
     if (typeof data === 'function') {
+        error = new Error('data must be a string and salt must either be a salt string or a number of rounds');
         return process.nextTick(function() {
-            data(new Error('data must be a string and salt must either be a salt string or a number of rounds'));
+            data(error);
         });
@@ -100,4 +106,5 @@ }
     if (typeof salt === 'function') {
+        error = new Error('data must be a string and salt must either be a salt string or a number of rounds');
         return process.nextTick(function() {
-            salt(new Error('data must be a string and salt must either be a salt string or a number of rounds'));
+            salt(error);
         });
@@ -117,4 +124,5 @@ }
     if (data == null || salt == null) {
+        error = new Error('data and salt arguments required');
         return process.nextTick(function() {
-            cb(new Error('data and salt arguments required'));
+            cb(error);
         });
@@ -124,4 +132,5 @@ }
     if (typeof data !== 'string' || (typeof salt !== 'string' && typeof salt !== 'number')) {
+        error = new Error('data must be a string and salt must either be a salt string or a number of rounds');
         return process.nextTick(function() {
-            cb(new Error('data must be a string and salt must either be a salt string or a number of rounds'));
+            cb(error);
         });
@@ -161,5 +170,8 @@ }
 module.exports.compare = function compare(data, hash, cb) {
+    var error;
+
     if (typeof data === 'function') {
+        error = new Error('data and hash arguments required');
         return process.nextTick(function() {
-            data(new Error('data and hash arguments required'));
+            data(error);
         });
@@ -169,4 +181,5 @@ }
     if (typeof hash === 'function') {
+        error = new Error('data and hash arguments required');
         return process.nextTick(function() {
-            hash(new Error('data and hash arguments required'));
+            hash(error);
         });
@@ -186,4 +199,5 @@ }
     if (data == null || hash == null) {
+        error = new Error('data and hash arguments required');
         return process.nextTick(function() {
-            cb(new Error('data and hash arguments required'));
+            cb(error);
         });
@@ -193,4 +207,5 @@ }
     if (typeof data !== 'string' || typeof hash !== 'string') {
+        error = new Error('data and hash must be strings');
         return process.nextTick(function() {
-            cb(new Error('data and hash must be strings'));
+            cb(error);
         });
@@ -197,0 +212,0 @@ }

CHANGELOG.md

@@ -0,1 +1,10 @@
+# 1.1.0-napi (2018-01-21)
+
+  * Initial support for [N-API](https://nodejs.org/api/n-api.html)
+
+# 1.0.3 (2016-08-23)
+
+  * update to nan v2.6.2 for NodeJS 8 support
+  * Fix: use npm scripts instead of node-gyp directly.
+
 # 1.0.2 (2016-12-31)
@@ -2,0 +11,0 @@

lib/promises.js

@@ -10,7 +10,2 @@ 'use strict';
 
-    //can't do anything without Promise so fail silently
-    if (typeof Promise === 'undefined') {
-        return;
-    }
-
     if (!Array.isArray(args)) {
@@ -39,10 +34,3 @@ args = Array.prototype.slice.call(args);
 module.exports.reject = function (err) {
-
-    // silently swallow errors if Promise is not defined
-    // emulating old behavior
-    if (typeof Promise === 'undefined') {
-        return;
-    }
-
     return Promise.reject(err);
 };

package.json

@@ -14,6 +14,6 @@ {
   "main": "./bcrypt",
-  "version": "1.0.3",
+  "version": "1.1.0-napi",
   "author": "Nick Campbell (https://github.com/ncb000gt)",
   "engines": {
-    "node": ">= 0.6.0"
+    "node": ">= 4.0.0"
   },
@@ -33,4 +33,5 @@ "repository": {
   "dependencies": {
-    "nan": "2.6.2",
-    "node-pre-gyp": "0.6.36"
+    "bindings": "1.3.0",
+    "node-addon-api": "1.1.0",
+    "node-pre-gyp": "0.6.39"
   },
@@ -55,3 +56,4 @@ "devDependencies": {
     "Fanie Oosthuysen <[e-mail]> (https://github.com/weareu)",
-    "Amitosh Swain Mahapatra <[e-mail]> (https://github.com/Agathver)"
+    "Amitosh Swain Mahapatra <[e-mail]> (https://github.com/Agathver)",
+    "Nicola Del Gobbo <[e-mail]> (https://github.com/NickNaso)"
   ],
@@ -64,2 +66,2 @@ "binary": {
   }
-}
+}

README.md

@@ -106,5 +106,10 @@ # node.bcrypt.js
 ```
+
+The "compare" function counters timing attacks (using a so-called 'constant-time' algorithm).
+In general, don't use the normal JavaScript string comparison functions to compare passwords,
+cryptographic keys, or cryptographic hashes if they are relevant to security.
+
 ### with promises
 
-bcrypt uses whatever Promise implementation is available in `global.Promise`. NodeJS >= 0.12 has a native Promise implementation built in. However, this should work in any Promises/A+ compilant implementation.
+bcrypt uses whatever Promise implementation is available in `global.Promise`. NodeJS >= 0.12 has a native Promise implementation built in. However, this should work in any Promises/A+ compliant implementation.
 
@@ -163,2 +168,5 @@ Async methods that accept a callback, return a `Promise` when callback is not specified if Promise support is available.
 ```
+The "compareSync" function counters timing attacks (using a so-called 'constant-time' algorithm).
+In general, don't use the normal JavaScript string comparison functions to compare passwords,
+cryptographic keys, or cryptographic hashes if they are relevant to security.
 
@@ -259,2 +267,3 @@ ### Why is async mode recommended over sync mode?
 * [Amitosh Swain Mahapatra][agathver] - ES6 Promise Support
+* [Nicola Del Gobbo][NickNaso] - Initial implementation with N-API
 
@@ -287,1 +296,2 @@ ## License
 [agathver]:https://github.com/Agathver
+[NickNaso]: https://github.com/NickNaso

test/async.js

@@ -7,3 +7,3 @@ var bcrypt = require('../bcrypt');
         bcrypt.genSalt(10, function(err, salt) {
-            assert.equals(29, salt.length, "Salt isn't the correct length.");
+            assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
             assert.done();
@@ -40,3 +40,3 @@ });
         bcrypt.hash('bacon', 8, function(err, hash) {
-          assert.equals(bcrypt.getRounds(hash), 8, "Number of rounds should be that specified in the function call.");
+          assert.strictEqual(bcrypt.getRounds(hash), 8, "Number of rounds should be that specified in the function call.");
           assert.done();
@@ -77,6 +77,6 @@ });
         bcrypt.hash('password', '$2a$10$somesaltyvaluertsetrse', function(err, enc) {
-            assert.equal(err, undefined);
+            assert.strictEqual(err, undefined);
             bcrypt.hash('password', 'some$value', function(err, enc) {
                 assert.notEqual(err, undefined);
-                assert.equal(err.message, "Invalid salt. Salt must be in the form of: $Vers$log2(NumRounds)$saltvalue");
+                assert.strictEqual(err.message, "Invalid salt. Salt must be in the form of: $Vers$log2(NumRounds)$saltvalue");
                 assert.done();
@@ -90,4 +90,4 @@ });
             var split_salt = salt.split('$');
-            assert.ok(split_salt[1], '2a');
-            assert.ok(split_salt[2], '10');
+            assert.strictEqual(split_salt[1], '2a');
+            assert.strictEqual(split_salt[2], '10');
             assert.done();
@@ -100,4 +100,4 @@ });
             var split_salt = salt.split('$');
-            assert.ok(split_salt[1], '2a');
-            assert.ok(split_salt[2], '4');
+            assert.strictEqual(split_salt[1], '2a');
+            assert.strictEqual(split_salt[2], '04');
             assert.done();
@@ -110,4 +110,4 @@ });
             var split_salt = salt.split('$');
-            assert.ok(split_salt[1], '2a');
-            assert.ok(split_salt[2], '31');
+            assert.strictEqual(split_salt[1], '2a');
+            assert.strictEqual(split_salt[2], '31');
             assert.done();
@@ -119,8 +119,8 @@ });
         bcrypt.genSalt(10, function(err, salt) {
-            assert.equals(29, salt.length, "Salt isn't the correct length.");
+            assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
             bcrypt.hash("test", salt, function(err, hash) {
                 bcrypt.compare("test", hash, function(err, res) {
-                    assert.equal(res, true, "These hashes should be equal.");
+                    assert.strictEqual(res, true, "These hashes should be equal.");
                     bcrypt.compare("blah", hash, function(err, res) {
-                        assert.equal(res, false, "These hashes should not be equal.");
+                        assert.strictEqual(res, false, "These hashes should not be equal.");
                         assert.done();
@@ -137,5 +137,5 @@ });
         bcrypt.compare("", hash, function(err, res) {
-          assert.equal(res, false, "These hashes should be equal.");
+          assert.strictEqual(res, false, "These hashes should not be equal.");
           bcrypt.compare("", "", function(err, res) {
-            assert.equal(res, false, "These hashes should be equal.");
+            assert.strictEqual(res, false, "These hashes should not be equal.");
             assert.done();
@@ -142,0 +142,0 @@ });

test/promise.js

@@ -14,7 +14,7 @@ var bcrypt = require('../bcrypt');
             // http://stackoverflow.com/questions/27746304/how-do-i-tell-if-an-object-is-a-promise
-            assert.ok(typeof bcrypt.genSalt().then === 'function', "Should return a promise");
+            assert.strictEqual(typeof bcrypt.genSalt().then, 'function', "Should return a promise");
             assert.done();
         },
         test_salt_returns_promise_on_null_callback: function(assert) {
-            assert.ok(typeof bcrypt.genSalt(13, null, null).then === 'function', "Should return a promise");
+            assert.strictEqual(typeof bcrypt.genSalt(13, null, null).then,'function', "Should return a promise");
             assert.done();
@@ -25,4 +25,4 @@ },
             bcrypt.genSalt(10).then(function(salt) {
-                assert.ok(typeof salt !== 'undefined', 'salt must not be undefined');
-                assert.equals(29, salt.length, "Salt isn't the correct length.");
+                assert.ok(salt,'salt must be defined');
+                assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
                 assert.done();
@@ -52,3 +52,3 @@ });
         test_hash_returns_promise_on_null_callback: function(assert) {
-            assert.ok(typeof bcrypt.hash('password', 10, null).then === 'function', "Should return a promise");
+            assert.strictEqual(typeof bcrypt.hash('password', 10, null).then,'function', "Should return a promise");
             assert.done();
@@ -68,3 +68,3 @@ },
             bcrypt.hash('bacon', 8).then(function(hash) {
-                assert.equals(bcrypt.getRounds(hash), 8, "Number of rounds should be that specified in the function call.");
+                assert.strictEqual(bcrypt.getRounds(hash), 8, "Number of rounds should be that specified in the function call.");
                 assert.done();
@@ -121,3 +121,3 @@ });
                         assert.notEqual(err, undefined);
-                        assert.equal(err.message, "Invalid salt. Salt must be in the form of: $Vers$log2(NumRounds)$saltvalue");
+                        assert.strictEqual(err.message, "Invalid salt. Salt must be in the form of: $Vers$log2(NumRounds)$saltvalue");
                     })
@@ -132,4 +132,4 @@ ]).then(function() {
                 var split_salt = salt.split('$');
-                assert.ok(split_salt[1], '2a');
-                assert.ok(split_salt[2], '10');
+                assert.strictEqual(split_salt[1], '2a');
+                assert.strictEqual(split_salt[2], '10');
                 assert.done();
@@ -142,4 +142,4 @@ });
                 var split_salt = salt.split('$');
-                assert.ok(split_salt[1], '2a');
-                assert.ok(split_salt[2], '4');
+                assert.strictEqual(split_salt[1], '2a');
+                assert.strictEqual(split_salt[2], '04');
                 assert.done();
@@ -152,4 +152,4 @@ });
                 var split_salt = salt.split('$');
-                assert.ok(split_salt[1], '2a');
-                assert.ok(split_salt[2], '31');
+                assert.strictEqual(split_salt[1], '2a');
+                assert.strictEqual(split_salt[2], '31');
                 assert.done();
@@ -159,3 +159,3 @@ });
         test_hash_compare_returns_promise_on_null_callback: function(assert) {
-            assert.ok(typeof bcrypt.compare('password', 'something', null).then === 'function', "Should return a promise");
+            assert.strictEqual(typeof bcrypt.compare('password', 'something', null).then, 'function', "Should return a promise");
             assert.done();
@@ -166,3 +166,3 @@ },
             bcrypt.genSalt(10).then(function(salt) {
-                assert.equals(29, salt.length, "Salt isn't the correct length.");
+                assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
                 return bcrypt.hash("test", salt);
@@ -173,6 +173,6 @@ }).then(function(hash) {
                         bcrypt.compare("test", hash).then(function(res) {
-                            assert.equal(res, true, "These hashes should be equal.");
+                            assert.strictEqual(res, true, "These hashes should be equal.");
                         }),
                         bcrypt.compare("blah", hash).then(function(res) {
-                            assert.equal(res, false, "These hashes should not be equal.");
+                            assert.strictEqual(res, false, "These hashes should not be equal.");
                         })
@@ -188,6 +188,6 @@ ]).then(function() {
             bcrypt.compare("", hash).then(function(res) {
-                assert.equal(res, false, "These hashes should be equal.");
+                assert.strictEqual(res, false, "These hashes should not be equal.");
                 return bcrypt.compare("", "");
             }).then(function(res) {
-                assert.equal(res, false, "These hashes should be equal.");
+                assert.strictEqual(res, false, "These hashes should not be equal.");
                 assert.done();
@@ -216,3 +216,3 @@ });
             }).catch(function(err) {
-                assert.equal(err.message, 'data and hash arguments required', 'Promise should be rejected when no parameters are supplied');
+                assert.strictEqual(err.message, 'data and hash arguments required', 'Promise should be rejected when no parameters are supplied');
             }).then(function() {
@@ -227,3 +227,3 @@ assert.done();
             }).catch(function(err) {
-                assert.equal(err.message, 'data and hash arguments required', 'Promise should be rejected when no parameters are supplied');
+                assert.strictEqual(err.message, 'data and hash arguments required', 'Promise should be rejected when no parameters are supplied');
             }).then(function() {
@@ -230,0 +230,0 @@ assert.done();

test/sync.js

@@ -6,6 +6,6 @@ var bcrypt = require('../bcrypt');
         var salt = bcrypt.genSaltSync(10);
-        assert.equals(29, salt.length, "Salt isn't the correct length.");
+        assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
         var split_salt = salt.split('$');
-        assert.ok(split_salt[1], '2a');
-        assert.ok(split_salt[2], '10');
+        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[2], '10');
         assert.done();
@@ -17,4 +17,4 @@ },
         var split_salt = salt.split('$');
-        assert.ok(split_salt[1], '2a');
-        assert.ok(split_salt[2], '10');
+        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[2], '10');
         assert.done();
@@ -36,3 +36,3 @@ },
         var hash = bcrypt.hashSync('password', 8);
-        assert.equals(bcrypt.getRounds(hash), 8, "Number of rounds should equal 8.");
+        assert.strictEqual(bcrypt.getRounds(hash), 8, "Number of rounds should equal 8.");
         assert.done();
@@ -69,4 +69,4 @@ },
         var split_salt = salt.split('$');
-        assert.ok(split_salt[1], '2a');
-        assert.ok(split_salt[2], '10');
+        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[2], '10');
         assert.done();
@@ -77,4 +77,4 @@ },
         var split_salt = salt.split('$');
-        assert.ok(split_salt[1], '2a');
-        assert.ok(split_salt[2], '4');
+        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[2], '04');
         assert.done();
@@ -85,4 +85,4 @@ },
         var split_salt = salt.split('$');
-        assert.ok(split_salt[1], '2a');
-        assert.ok(split_salt[2], '31');
+        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[2], '31');
         assert.done();
@@ -92,3 +92,3 @@ },
         var salt = bcrypt.genSaltSync(10);
-        assert.equals(29, salt.length, "Salt isn't the correct length.");
+        assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
         var hash = bcrypt.hashSync("test", salt);
@@ -119,3 +119,3 @@ assert.ok(bcrypt.compareSync("test", hash), "These hashes should be equal.");
         var hash = bcrypt.hashSync("test", bcrypt.genSaltSync(9));
-        assert.equals(9, bcrypt.getRounds(hash), "getRounds can't extract rounds");
+        assert.strictEqual(9, bcrypt.getRounds(hash), "getRounds can't extract rounds");
         assert.done();
@@ -125,3 +125,3 @@ },
         var hash = bcrypt.hashSync("test", bcrypt.genSaltSync(9));
-        assert.equals(9, bcrypt.getRounds(hash), "getRounds can't extract rounds");
+        assert.strictEqual(9, bcrypt.getRounds(hash), "getRounds can't extract rounds");
         assert.throws(function() {bcrypt.getRounds(''); }, "Must pass a valid hash to getRounds");
@@ -128,0 +128,0 @@ assert.done();

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Fixed alerts

Deprecated

Maintenance

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

103919

increased by4.67%

Lines of code

863

increased by3.6%

Number of high maintenance alerts

0

decreased by-100%

Number of lines in readme file

294

increased by3.52%

Worsened metrics

Dependency count

3

increased by50%

Number of low quality alerts

2

increased by100%

Number of medium supply chain risk alerts

2

increased by100%

Dependency changes

• + Addedbindings@1.3.0

• + Addednode-addon-api@1.1.0

• + Addedajv@4.11.8(transitive)

• + Addedassert-plus@0.2.0(transitive)

• + Addedaws-sign2@0.6.0(transitive)

• + Addedbindings@1.3.0(transitive)

• + Addedboom@2.10.1(transitive)

• + Addedcall-bind@1.0.7(transitive)

• + Addedco@4.6.0(transitive)

• + Addedcryptiles@2.0.5(transitive)

• + Addeddefine-data-property@1.1.4(transitive)

• + Addeddetect-libc@1.0.3(transitive)

• + Addedes-define-property@1.0.0(transitive)

• + Addedes-errors@1.3.0(transitive)

• + Addedform-data@2.1.4(transitive)

• + Addedfunction-bind@1.1.2(transitive)

• + Addedget-intrinsic@1.2.4(transitive)

• + Addedgopd@1.0.1(transitive)

• + Addedhar-schema@1.0.5(transitive)

• + Addedhar-validator@4.2.1(transitive)

• + Addedhas-property-descriptors@1.0.2(transitive)

• + Addedhas-proto@1.0.3(transitive)

• + Addedhas-symbols@1.0.3(transitive)

• + Addedhasown@2.0.2(transitive)

• + Addedhawk@3.1.3(transitive)

• + Addedhoek@2.16.3(transitive)

• + Addedhttp-signature@1.1.1(transitive)

• + Addedisarray@2.0.5(transitive)

• + Addedjson-stable-stringify@1.1.1(transitive)

• + Addedjsonify@0.0.1(transitive)

• + Addednode-addon-api@1.1.0(transitive)

• + Addednode-pre-gyp@0.6.39(transitive)

• + Addedoauth-sign@0.8.2(transitive)

• + Addedobject-keys@1.1.1(transitive)

• + Addedperformance-now@0.2.0(transitive)

• + Addedpunycode@1.4.1(transitive)

• + Addedqs@6.4.1(transitive)

• + Addedrequest@2.81.0(transitive)

• + Addedset-function-length@1.2.2(transitive)

• + Addedsntp@1.0.9(transitive)

• + Addedstringstream@0.0.6(transitive)

• + Addedtough-cookie@2.3.4(transitive)

• - Removednan@2.6.2

• - Removedajv@6.12.6(transitive)

• - Removedaws-sign2@0.7.0(transitive)

• - Removedfast-deep-equal@3.1.3(transitive)

• - Removedfast-json-stable-stringify@2.1.0(transitive)

• - Removedform-data@2.3.3(transitive)

• - Removedhar-schema@2.0.0(transitive)

• - Removedhar-validator@5.1.5(transitive)

• - Removedhttp-signature@1.2.0(transitive)

• - Removedjson-schema-traverse@0.4.1(transitive)

• - Removednan@2.6.2(transitive)

• - Removednode-pre-gyp@0.6.36(transitive)

• - Removedoauth-sign@0.9.0(transitive)

• - Removedperformance-now@2.1.0(transitive)

• - Removedpsl@1.9.0(transitive)

• - Removedpunycode@2.3.1(transitive)

• - Removedqs@6.5.3(transitive)

• - Removedrequest@2.88.2(transitive)

• - Removedtough-cookie@2.5.0(transitive)

• - Removeduri-js@4.4.1(transitive)

• Updatednode-pre-gyp@0.6.39