bcrypt - npm Package Compare versions

Comparing version 1.1.0-napi to 2.0.0

bcrypt.js

@@ -15,3 +15,3 @@ 'use strict';
 /// @return {String} salt
-module.exports.genSaltSync = function genSaltSync(rounds) {
+module.exports.genSaltSync = function genSaltSync(rounds, minor) {
     // default 10 rounds
@@ -24,3 +24,10 @@ if (!rounds) {
 
-    return bindings.gen_salt_sync(rounds, crypto.randomBytes(16));
+    if(!minor) {
+        minor = 'b';
+    } else if(minor !== 'b' && minor !== 'a') {
+        console.log(minor, typeof minor);
+        throw new Error('minor must be either "a" or "b"');
+    }
+
+    return bindings.gen_salt_sync(minor, rounds, crypto.randomBytes(16));
 };
@@ -31,3 +38,3 @@
 /// @param {Function} cb callback(err, salt)
-module.exports.genSalt = function genSalt(rounds, ignore, cb) {
+module.exports.genSalt = function genSalt(rounds, minor, cb) {
     var error;
@@ -40,2 +47,3 @@
         rounds = 10;
+        minor = 'b';
     // callback is second argument
@@ -45,6 +53,7 @@ } else if (typeof arguments[1] === 'function') {
         cb = arguments[1];
+        minor = 'b';
     }
 
     if (!cb) {
-        return promises.promise(genSalt, this, [rounds, ignore]);
+        return promises.promise(genSalt, this, [rounds, minor]);
     }
@@ -63,2 +72,11 @@
 
+    if(!minor) {
+        minor = 'b'
+    } else if(minor !== 'b' && minor !== 'a') {
+        error = new Error('minor must be either "a" or "b"');
+        return process.nextTick(function() {
+            cb(error);
+        });
+    }
+
     crypto.randomBytes(16, function(error, randomBytes) {
@@ -70,3 +88,3 @@ if (error) {
 
-        bindings.gen_salt(rounds, randomBytes, cb);
+        bindings.gen_salt(minor, rounds, randomBytes, cb);
     });
@@ -73,0 +91,0 @@ };

CHANGELOG.md

@@ -1,10 +0,5 @@
-# 1.1.0-napi (2018-01-21)
+# 2.0.0 (2018-04-07)
 
-  * Initial support for [N-API](https://nodejs.org/api/n-api.html)
+  * Make `2b` the default bcrypt version
 
-# 1.0.3 (2016-08-23)
-
-  * update to nan v2.6.2 for NodeJS 8 support
-  * Fix: use npm scripts instead of node-gyp directly.
-
 # 1.0.2 (2016-12-31)
@@ -11,0 +6,0 @@

lib/promises.js

 'use strict';
 
+var Promise = global.Promise;
+
 /// encapsulate a method with a node-style callback in a Promise
@@ -7,3 +9,3 @@ /// @param {object} 'this' of the encapsulated function
 /// @param {Array-like} args to be passed to the called function
-/// @return {Promise} a Promise encapuslaing the function
+/// @return {Promise} a Promise encapsulating the function
 module.exports.promise = function (fn, context, args) {
@@ -36,1 +38,7 @@
 };
+
+/// changes the promise implementation that bcrypt uses
+/// @param {Promise} the implementation to use
+module.exports.use = function(promise) {
+  Promise = promise;
+};

package.json

@@ -14,3 +14,3 @@ {
   "main": "./bcrypt",
-  "version": "1.1.0-napi",
+  "version": "2.0.0",
   "author": "Nick Campbell (https://github.com/ncb000gt)",
@@ -33,8 +33,7 @@ "engines": {
   "dependencies": {
-    "bindings": "1.3.0",
-    "node-addon-api": "1.1.0",
-    "node-pre-gyp": "0.6.39"
+    "nan": "2.10.0",
+    "node-pre-gyp": "0.9.0"
   },
   "devDependencies": {
-    "nodeunit": "~0.9.1"
+    "nodeunit": "~0.11.1"
   },
@@ -56,4 +55,3 @@ "contributors": [
     "Fanie Oosthuysen <[e-mail]> (https://github.com/weareu)",
-    "Amitosh Swain Mahapatra <[e-mail]> (https://github.com/Agathver)",
-    "Nicola Del Gobbo <[e-mail]> (https://github.com/NickNaso)"
+    "Amitosh Swain Mahapatra <[e-mail]> (https://github.com/Agathver)"
   ],
@@ -64,4 +62,5 @@ "binary": {
     "host": "https://github.com",
-    "remote_path": "/kelektiv/node.bcrypt.js/releases/download/v{version}/"
+    "remote_path": "/kelektiv/node.bcrypt.js/releases/download/v{version}/",
+    "package_name": "{module_name}-v{version}-{node_abi}-{platform}-{arch}-{libc}.tar.gz"
   }
 }

README.md

@@ -45,2 +45,8 @@ # node.bcrypt.js
 
+## Compatibility Note
+
+This library supports `$2a$` and `$2b$` prefix bcrypt hashes. `$2x$` and `$2y$` hashes are specific to bcrypt implementation developed for Jon the Ripper. In theory, they should be compatible with `$2b$` prefix.
+
+Compatibility with hashes generated by other languages is not 100% guaranteed due to difference in character encodings. However, it should not be an issue for most cases.
+
 ## Dependencies
@@ -179,6 +185,8 @@
 
-  * `genSaltSync(rounds)`
+  * `genSaltSync(rounds, minor)`
     * `rounds` - [OPTIONAL] - the cost of processing the data. (default - 10)
-  * `genSalt(rounds, cb)`
+    * `minor` - [OPTIONAL] - minor version of bcrypt to use. (default - b)
+  * `genSalt(rounds, minor, cb)`
     * `rounds` - [OPTIONAL] - the cost of processing the data. (default - 10)
+    * `minor` - [OPTIONAL] - minor version of bcrypt to use. (default - b)
     * `cb` - [OPTIONAL] - a callback to be fired once the salt has been generated. uses eio making it asynchronous. If `cb` is not specified, a `Promise` is returned if Promise support is available.
@@ -266,4 +274,3 @@ * `err` - First parameter to the callback detailing any errors.
 * [Fanie Oosthuysen][weareu] - Windows Support
-* [Amitosh Swain Mahapatra][agathver] - ES6 Promise Support
-* [Nicola Del Gobbo][NickNaso] - Initial implementation with N-API
+* [Amitosh Swain Mahapatra][agathver] - $2b$ hash support, ES6 Promise support
 
@@ -296,2 +303,1 @@ ## License
 [agathver]:https://github.com/Agathver
-[NickNaso]: https://github.com/NickNaso

test/async.js

@@ -22,3 +22,3 @@ var bcrypt = require('../bcrypt');
     test_salt_rounds_is_string_non_number: function(assert) {
-        bcrypt.genSalt('b', function (err, salt) {
+        bcrypt.genSalt('z', function (err, salt) {
             assert.ok((err instanceof Error), "Should throw an Error. genSalt requires rounds to of type number.");
@@ -28,2 +28,22 @@ assert.done();
     },
+    test_salt_minor: function(assert) {
+        assert.expect(3);
+        bcrypt.genSalt(10, 'a', function(err, salt) {
+            assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+            var split_salt = salt.split('$');
+            assert.strictEqual(split_salt[1], '2a');
+            assert.strictEqual(split_salt[2], '10');
+            assert.done();
+        });
+    },
+    test_salt_minor_b: function(assert) {
+        assert.expect(3);
+        bcrypt.genSalt(10, 'b', function(err, salt) {
+            assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+            var split_salt = salt.split('$');
+            assert.strictEqual(split_salt[1], '2b');
+            assert.strictEqual(split_salt[2], '10');
+            assert.done();
+        });
+    },
     test_hash: function(assert) {
@@ -89,3 +109,3 @@ assert.expect(1);
             var split_salt = salt.split('$');
-            assert.strictEqual(split_salt[1], '2a');
+            assert.strictEqual(split_salt[1], '2b');
             assert.strictEqual(split_salt[2], '10');
@@ -99,3 +119,3 @@ assert.done();
             var split_salt = salt.split('$');
-            assert.strictEqual(split_salt[1], '2a');
+            assert.strictEqual(split_salt[1], '2b');
             assert.strictEqual(split_salt[2], '04');
@@ -109,3 +129,3 @@ assert.done();
             var split_salt = salt.split('$');
-            assert.strictEqual(split_salt[1], '2a');
+            assert.strictEqual(split_salt[1], '2b');
             assert.strictEqual(split_salt[2], '31');
@@ -112,0 +132,0 @@ assert.done();

test/implementation.js

@@ -14,2 +14,7 @@ var bcrypt = require('../bcrypt');
     },
+    openbsd_bcrypt_tests: function(assert) {
+        assert.strictEqual(bcrypt.hashSync("000000000000000000000000000000000000000000000000000000000000000000000000", "$2a$05$CCCCCCCCCCCCCCCCCCCCC."), "$2a$05$CCCCCCCCCCCCCCCCCCCCC.6.O1dLNbjod2uo0DVcW.jHucKbPDdHS");
+        assert.strictEqual(bcrypt.hashSync("000000000000000000000000000000000000000000000000000000000000000000000000", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.6.O1dLNbjod2uo0DVcW.jHucKbPDdHS");
+        assert.done();
+    },
     test_long_passwords: function(assert) {
@@ -19,2 +24,6 @@ // bcrypt wrap-around bug in $2a$
         assert.strictEqual(bcrypt.hashSync("0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345", "$2a$05$CCCCCCCCCCCCCCCCCCCCC."), "$2a$05$CCCCCCCCCCCCCCCCCCCCC.6.O1dLNbjod2uo0DVcW.jHucKbPDdHS");
+
+        // tests for $2b$ which fixes wrap-around bugs
+        assert.strictEqual(bcrypt.hashSync("012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.XxrQqgBi/5Sxuq9soXzDtjIZ7w5pMfK");
+        assert.strictEqual(bcrypt.hashSync("0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345", "$2b$05$CCCCCCCCCCCCCCCCCCCCC."), "$2b$05$CCCCCCCCCCCCCCCCCCCCC.6.O1dLNbjod2uo0DVcW.jHucKbPDdHS");
         assert.done();
@@ -28,3 +37,10 @@ },
         assert.done();
+    },
+    test_consistency: function(assert) {
+        assert.strictEqual(bcrypt.hashSync("ππππππππ", "$2a$10$.TtQJ4Jr6isd4Hp.mVfZeu"), "$2a$10$.TtQJ4Jr6isd4Hp.mVfZeuh6Gws4rOQ/vdBczhDx.19NFK0Y84Dle");
+        assert.strictEqual(bcrypt.hashSync("p@5sw0rd", "$2b$12$zQ4CooEXdGqcwi0PHsgc8e"), "$2b$12$zQ4CooEXdGqcwi0PHsgc8eAf0DLXE/XHoBE8kCSGQ97rXwuClaPam");
+        assert.strictEqual(bcrypt.hashSync("C'est bon, la vie!", "$2b$12$cbo7LZ.wxgW4yxAA5Vqlv."), "$2b$12$cbo7LZ.wxgW4yxAA5Vqlv.KR6QFPt4qCdc9RYJNXxa/rbUOp.1sw.");
+        assert.strictEqual(bcrypt.hashSync("ἓν οἶδα ὅτι οὐδὲν οἶδα", "$2b$12$LeHKWR2bmrazi/6P22Jpau"), "$2b$12$LeHKWR2bmrazi/6P22JpauX5my/eKwwKpWqL7L5iEByBnxNc76FRW");
+        assert.done();
     }
-}
+}

test/promise.js

 var bcrypt = require('../bcrypt');
+var promises = require('../lib/promises');
 
@@ -127,3 +128,3 @@ var fail = function(assert, error) {
                 var split_salt = salt.split('$');
-                assert.strictEqual(split_salt[1], '2a');
+                assert.strictEqual(split_salt[1], '2b');
                 assert.strictEqual(split_salt[2], '10');
@@ -137,3 +138,3 @@ assert.done();
                 var split_salt = salt.split('$');
-                assert.strictEqual(split_salt[1], '2a');
+                assert.strictEqual(split_salt[1], '2b');
                 assert.strictEqual(split_salt[2], '04');
@@ -147,3 +148,3 @@ assert.done();
                 var split_salt = salt.split('$');
-                assert.strictEqual(split_salt[1], '2a');
+                assert.strictEqual(split_salt[1], '2b');
                 assert.strictEqual(split_salt[2], '31');
@@ -221,4 +222,35 @@ assert.done();
             });
+        },
+        test_change_promise_impl_reject: function(assert) {
+
+          promises.use({
+            reject: function() {
+              return 'mock';
+            }
+          });
+
+          assert.equal(promises.reject(), 'mock');
+
+          // need to reset the promise implementation because of require cache
+          promises.use(global.Promise);
+          assert.done();
+
+        },
+        test_change_promise_impl_promise: function(assert) {
+
+          promises.use({
+            reject: function(err) {
+              assert.equal(err.message, 'fn must be a function');
+              return 'mock';
+            }
+          });
+
+          assert.equal(promises.promise('', '', ''), 'mock');
+
+          // need to reset the promise implementation because of require cache
+          promises.use(global.Promise);
+          assert.done();
+
         }
     };
 }

test/sync.js

@@ -8,3 +8,3 @@ var bcrypt = require('../bcrypt');
         var split_salt = salt.split('$');
-        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[1], '2b');
         assert.strictEqual(split_salt[2], '10');
@@ -17,3 +17,3 @@ assert.done();
         var split_salt = salt.split('$');
-        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[1], '2b');
         assert.strictEqual(split_salt[2], '10');
@@ -30,2 +30,18 @@ assert.done();
     },
+    test_salt_minor_a: function(assert) {
+        var salt = bcrypt.genSaltSync(10, 'a');
+        assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+        var split_salt = salt.split('$');
+        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[2], '10');
+        assert.done();
+    },
+    test_salt_minor_b: function(assert) {
+        var salt = bcrypt.genSaltSync(10, 'b');
+        assert.strictEqual(29, salt.length, "Salt isn't the correct length.");
+        var split_salt = salt.split('$');
+        assert.strictEqual(split_salt[1], '2b');
+        assert.strictEqual(split_salt[2], '10');
+        assert.done();
+    },
     test_hash: function(assert) {
@@ -61,3 +77,3 @@ assert.ok(bcrypt.hashSync('password', bcrypt.genSaltSync(10)), "Shouldn't throw an Error.");
         assert.ok(bcrypt.hashSync('password', '$2a$10$somesaltyvaluertsetrse'));
-        assert.throws(function() { 
+        assert.throws(function() {
             bcrypt.hashSync('password', 'some$value');
@@ -70,3 +86,3 @@ });
         var split_salt = salt.split('$');
-        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[1], '2b');
         assert.strictEqual(split_salt[2], '10');
@@ -78,3 +94,3 @@ assert.done();
         var split_salt = salt.split('$');
-        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[1], '2b');
         assert.strictEqual(split_salt[2], '04');
@@ -86,3 +102,3 @@ assert.done();
         var split_salt = salt.split('$');
-        assert.strictEqual(split_salt[1], '2a');
+        assert.strictEqual(split_salt[1], '2b');
         assert.strictEqual(split_salt[2], '31');
@@ -89,0 +105,0 @@ assert.done();

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Deprecated

Maintenance

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

108765

increased by4.66%

Dependency count

2

decreased by-33.33%

Number of package files

24

increased by4.35%

Lines of code

963

increased by11.59%

Number of low quality alerts

1

decreased by-50%

Number of lines in readme file

300

increased by2.04%

Number of medium supply chain risk alerts

1

decreased by-50%

Worsened metrics

Number of medium maintenance alerts

1

increased byInfinity%

Dependency changes

• + Addednan@2.10.0

• + Addedchownr@1.1.4(transitive)

• + Addeddebug@3.2.7(transitive)

• + Addedfs-minipass@1.2.7(transitive)

• + Addediconv-lite@0.4.24(transitive)

• + Addedignore-walk@3.0.4(transitive)

• + Addedminipass@2.9.0(transitive)

• + Addedminizlib@1.3.3(transitive)

• + Addedms@2.1.3(transitive)

• + Addednan@2.10.0(transitive)

• + Addedneedle@2.9.1(transitive)

• + Addednode-pre-gyp@0.9.0(transitive)

• + Addednpm-bundled@1.1.2(transitive)

• + Addednpm-normalize-package-bin@1.0.1(transitive)

• + Addednpm-packlist@1.4.8(transitive)

• + Addedsafe-buffer@5.2.1(transitive)

• + Addedsax@1.4.1(transitive)

• + Addedtar@4.4.19(transitive)

• + Addedyallist@3.1.1(transitive)

• - Removedbindings@1.3.0

• - Removednode-addon-api@1.1.0

• - Removedajv@4.11.8(transitive)

• - Removedasn1@0.2.6(transitive)

• - Removedassert-plus@0.2.01.0.0(transitive)

• - Removedasynckit@0.4.0(transitive)

• - Removedaws-sign2@0.6.0(transitive)

• - Removedaws4@1.13.2(transitive)

• - Removedbcrypt-pbkdf@1.0.2(transitive)

• - Removedbindings@1.3.0(transitive)

• - Removedblock-stream@0.0.9(transitive)

• - Removedboom@2.10.1(transitive)

• - Removedcall-bind@1.0.7(transitive)

• - Removedcaseless@0.12.0(transitive)

• - Removedco@4.6.0(transitive)

• - Removedcombined-stream@1.0.8(transitive)

• - Removedcore-util-is@1.0.2(transitive)

• - Removedcryptiles@2.0.5(transitive)

• - Removeddashdash@1.14.1(transitive)

• - Removeddebug@2.6.9(transitive)

• - Removeddefine-data-property@1.1.4(transitive)

• - Removeddelayed-stream@1.0.0(transitive)

• - Removedecc-jsbn@0.1.2(transitive)

• - Removedes-define-property@1.0.0(transitive)

• - Removedes-errors@1.3.0(transitive)

• - Removedextend@3.0.2(transitive)

• - Removedextsprintf@1.3.0(transitive)

• - Removedforever-agent@0.6.1(transitive)

• - Removedform-data@2.1.4(transitive)

• - Removedfstream@1.0.12(transitive)

• - Removedfstream-ignore@1.0.5(transitive)

• - Removedfunction-bind@1.1.2(transitive)

• - Removedget-intrinsic@1.2.4(transitive)

• - Removedgetpass@0.1.7(transitive)

• - Removedgopd@1.0.1(transitive)

• - Removedgraceful-fs@4.2.11(transitive)

• - Removedhar-schema@1.0.5(transitive)

• - Removedhar-validator@4.2.1(transitive)

• - Removedhas-property-descriptors@1.0.2(transitive)

• - Removedhas-proto@1.0.3(transitive)

• - Removedhas-symbols@1.0.3(transitive)

• - Removedhasown@2.0.2(transitive)

• - Removedhawk@3.1.3(transitive)

• - Removedhoek@2.16.3(transitive)

• - Removedhttp-signature@1.1.1(transitive)

• - Removedis-typedarray@1.0.0(transitive)

• - Removedisarray@2.0.5(transitive)

• - Removedisstream@0.1.2(transitive)

• - Removedjsbn@0.1.1(transitive)

• - Removedjson-schema@0.4.0(transitive)

• - Removedjson-stable-stringify@1.1.1(transitive)

• - Removedjson-stringify-safe@5.0.1(transitive)

• - Removedjsonify@0.0.1(transitive)

• - Removedjsprim@1.4.2(transitive)

• - Removedmime-db@1.52.0(transitive)

• - Removedmime-types@2.1.35(transitive)

• - Removedms@2.0.0(transitive)

• - Removednode-addon-api@1.1.0(transitive)

• - Removednode-pre-gyp@0.6.39(transitive)

• - Removedoauth-sign@0.8.2(transitive)

• - Removedobject-keys@1.1.1(transitive)

• - Removedperformance-now@0.2.0(transitive)

• - Removedpunycode@1.4.1(transitive)

• - Removedqs@6.4.1(transitive)

• - Removedrequest@2.81.0(transitive)

• - Removedset-function-length@1.2.2(transitive)

• - Removedsntp@1.0.9(transitive)

• - Removedsshpk@1.18.0(transitive)

• - Removedstringstream@0.0.6(transitive)

• - Removedtar@2.2.2(transitive)

• - Removedtar-pack@3.4.1(transitive)

• - Removedtough-cookie@2.3.4(transitive)

• - Removedtunnel-agent@0.6.0(transitive)

• - Removedtweetnacl@0.14.5(transitive)

• - Removeduid-number@0.0.6(transitive)

• - Removeduuid@3.4.0(transitive)

• - Removedverror@1.10.0(transitive)

• Updatednode-pre-gyp@0.9.0