crypto-js - npm Package Compare versions

Comparing version 3.1.9-1 to 3.2.0

aes.js

@@ -94,2 +94,4 @@ ;(function (root, factory, undef) {
 	        _doReset: function () {
+	            var t;
+
 	            // Skip reset of nRounds has been set before and key did not change
@@ -117,3 +119,3 @@ if (this._nRounds && this._keyPriorReset === this._key) {
 	                } else {
-	                    var t = keySchedule[ksRow - 1];
+	                    t = keySchedule[ksRow - 1];
 
@@ -120,0 +122,0 @@ if (!(ksRow % keySize)) {

bower.json

 {
   "name": "crypto-js",
-  "version": "3.1.9",
+  "version": "3.2.0",
   "description": "JavaScript library of crypto standards.",
@@ -5,0 +5,0 @@ "license": "MIT",

cipher-core.js

@@ -354,2 +354,4 @@ ;(function (root, factory, undef) {
 	        function xorBlock(words, offset, blockSize) {
+	            var block;
+
 	            // Shortcut
@@ -360,3 +362,3 @@ var iv = this._iv;
 	            if (iv) {
-	                var block = iv;
+	                block = iv;
 
@@ -366,3 +368,3 @@ // Remove IV for subsequent blocks
 	            } else {
-	                var block = this._prevBlock;
+	                block = this._prevBlock;
 	            }
@@ -459,2 +461,4 @@
 	        reset: function () {
+	            var modeCreator;
+
 	            // Reset cipher
@@ -470,5 +474,5 @@ Cipher.reset.call(this);
 	            if (this._xformMode == this._ENC_XFORM_MODE) {
-	                var modeCreator = mode.createEncryptor;
+	                modeCreator = mode.createEncryptor;
 	            } else /* if (this._xformMode == this._DEC_XFORM_MODE) */ {
-	                var modeCreator = mode.createDecryptor;
+	                modeCreator = mode.createDecryptor;
 	                // Keep at least one block in the buffer for unpadding
@@ -491,2 +495,4 @@ this._minBufferSize = 1;
 	        _doFinalize: function () {
+	            var finalProcessedBlocks;
+
 	            // Shortcut
@@ -501,6 +507,6 @@ var padding = this.cfg.padding;
 	                // Process final blocks
-	                var finalProcessedBlocks = this._process(!!'flush');
+	                finalProcessedBlocks = this._process(!!'flush');
 	            } else /* if (this._xformMode == this._DEC_XFORM_MODE) */ {
 	                // Process final blocks
-	                var finalProcessedBlocks = this._process(!!'flush');
+	                finalProcessedBlocks = this._process(!!'flush');
 
@@ -597,2 +603,4 @@ // Unpad data
 	        stringify: function (cipherParams) {
+	            var wordArray;
+
 	            // Shortcuts
@@ -604,5 +612,5 @@ var ciphertext = cipherParams.ciphertext;
 	            if (salt) {
-	                var wordArray = WordArray.create([0x53616c74, 0x65645f5f]).concat(salt).concat(ciphertext);
+	                wordArray = WordArray.create([0x53616c74, 0x65645f5f]).concat(salt).concat(ciphertext);
 	            } else {
-	                var wordArray = ciphertext;
+	                wordArray = ciphertext;
 	            }
@@ -627,2 +635,4 @@
 	        parse: function (openSSLStr) {
+	            var salt;
+
 	            // Parse base64
@@ -637,3 +647,3 @@ var ciphertext = Base64.parse(openSSLStr);
 	                // Extract salt
-	                var salt = WordArray.create(ciphertextWords.slice(2, 4));
+	                salt = WordArray.create(ciphertextWords.slice(2, 4));
 
@@ -640,0 +650,0 @@ // Remove salt from ciphertext

core.js

@@ -20,7 +20,36 @@ ;(function (root, factory) {
 	var CryptoJS = CryptoJS || (function (Math, undefined) {
+
 	    /*
-	     * Local polyfil of Object.create
+	     * Cryptographically secure pseudorandom number generator
+	     *
+	     * As Math.random() is cryptographically not safe to use
 	     */
+	    var secureRandom = function () {
+	        // Native crypto module on NodeJS environment
+	        try {
+	            // Crypto from global object
+	            var crypto = global.crypto;
+
+	            // Create a random float number between 0 and 1
+	            return Number('0.' + crypto.randomBytes(3).readUIntBE(0, 3));
+	        } catch (err) {}
+
+	        // Native crypto module in Browser environment
+	        try {
+	            // Support experimental crypto module in IE 11
+	            var crypto = window.crypto || window.msCrypto;
+
+	            // Create a random float number between 0 and 1
+	            return Number('0.' + window.crypto.getRandomValues(new Uint32Array(1))[0]);
+	        } catch (err) {}
+
+	        throw new Error('Native crypto module could not be used to get secure random number.');
+	    };
+
+	    /*
+	     * Local polyfill of Object.create
+
+	     */
 	    var create = Object.create || (function () {
-	        function F() {};
+	        function F() {}
 
@@ -308,22 +337,4 @@ return function (obj) {
 
-	            var r = (function (m_w) {
-	                var m_w = m_w;
-	                var m_z = 0x3ade68b1;
-	                var mask = 0xffffffff;
-
-	                return function () {
-	                    m_z = (0x9069 * (m_z & 0xFFFF) + (m_z >> 0x10)) & mask;
-	                    m_w = (0x4650 * (m_w & 0xFFFF) + (m_w >> 0x10)) & mask;
-	                    var result = ((m_z << 0x10) + m_w) & mask;
-	                    result /= 0x100000000;
-	                    result += 0.5;
-	                    return result * (Math.random() > .5 ? 1 : -1);
-	                }
-	            });
-
-	            for (var i = 0, rcache; i < nBytes; i += 4) {
-	                var _r = r((rcache || Math.random()) * 0x100000000);
-
-	                rcache = _r() * 0x3ade67b7;
-	                words.push((_r() * 0x100000000) | 0);
+	            for (var i = 0; i < nBytes; i += 4) {
+	                words.push((secureRandom() * 0x100000000) | 0);
 	            }
@@ -559,2 +570,4 @@
 	        _process: function (doFlush) {
+	            var processedWords;
+
 	            // Shortcuts
@@ -592,3 +605,3 @@ var data = this._data;
 	                // Remove processed words
-	                var processedWords = dataWords.splice(0, nWordsReady);
+	                processedWords = dataWords.splice(0, nWordsReady);
 	                data.sigBytes -= nBytesReady;
@@ -595,0 +608,0 @@ }

enc-base64.js

@@ -124,3 +124,4 @@ ;(function (root, factory) {
 	              var bits2 = reverseMap[base64Str.charCodeAt(i)] >>> (6 - (i % 4) * 2);
-	              words[nBytes >>> 2] |= (bits1 | bits2) << (24 - (nBytes % 4) * 8);
+	              var bitsCombined = bits1 | bits2;
+	              words[nBytes >>> 2] |= bitsCombined << (24 - (nBytes % 4) * 8);
 	              nBytes++;
@@ -127,0 +128,0 @@ }

evpkdf.js

@@ -71,2 +71,4 @@ ;(function (root, factory, undef) {
 	        compute: function (password, salt) {
+	            var block;
+
 	            // Shortcut
@@ -91,3 +93,3 @@ var cfg = this.cfg;
 	                }
-	                var block = hasher.update(password).finalize(salt);
+	                block = hasher.update(password).finalize(salt);
 	                hasher.reset();
@@ -94,0 +96,0 @@

mode-cfb.js

@@ -52,2 +52,4 @@ ;(function (root, factory, undef) {
 	    function generateKeystreamAndEncrypt(words, offset, blockSize, cipher) {
+	        var keystream;
+
 	        // Shortcut
@@ -58,3 +60,3 @@ var iv = this._iv;
 	        if (iv) {
-	            var keystream = iv.slice(0);
+	            keystream = iv.slice(0);
 
@@ -64,3 +66,3 @@ // Remove IV for subsequent blocks
 	        } else {
-	            var keystream = this._prevBlock;
+	            keystream = this._prevBlock;
 	        }
@@ -67,0 +69,0 @@ cipher.encryptBlock(keystream, 0);

package.json

 {
   "name": "crypto-js",
-  "version": "3.1.9-1",
+  "version": "3.2.0",
   "description": "JavaScript library of crypto standards.",
@@ -5,0 +5,0 @@ "license": "MIT",

pad-zeropadding.js

@@ -35,6 +35,8 @@ ;(function (root, factory, undef) {
 	        var i = data.sigBytes - 1;
-	        while (!((dataWords[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff)) {
-	            i--;
+	        for (var i = data.sigBytes - 1; i >= 0; i--) {
+	            if (((dataWords[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff)) {
+	                data.sigBytes = i + 1;
+	                break;
+	            }
 	        }
-	        data.sigBytes = i + 1;
 	    }
@@ -41,0 +43,0 @@ };

README.md

@@ -1,2 +0,2 @@
-# crypto-js
+# crypto-js [![Build Status](https://travis-ci.org/brix/crypto-js.svg?branch=develop)](https://travis-ci.org/brix/crypto-js)
 
@@ -18,2 +18,14 @@ JavaScript library of crypto standards.
 
+ES6 import for typical API call signing use case:
+
+```javascript
+import sha256 from 'crypto-js/sha256';
+import hmacSHA512 from 'crypto-js/hmac-sha512';
+import Base64 from 'crypto-js/enc-base64';
+
+const message, nonce, path, privateKey; // ...
+const hashDigest = sha256(nonce + message);
+const hmacDigest = Base64.stringify(hmacSHA512(path + hashDigest, privateKey));
+```
+
 Modular include:
@@ -93,3 +105,3 @@
 
-See: https://code.google.com/p/crypto-js
+See: https://cryptojs.gitbook.io/docs/
 
@@ -104,9 +116,9 @@ ### AES Encryption
 // Encrypt
-var ciphertext = CryptoJS.AES.encrypt('my message', 'secret key 123');
+var ciphertext = CryptoJS.AES.encrypt('my message', 'secret key 123').toString();
 
 // Decrypt
-var bytes  = CryptoJS.AES.decrypt(ciphertext.toString(), 'secret key 123');
-var plaintext = bytes.toString(CryptoJS.enc.Utf8);
+var bytes  = CryptoJS.AES.decrypt(ciphertext, 'secret key 123');
+var originalText = bytes.toString(CryptoJS.enc.Utf8);
 
-console.log(plaintext);
+console.log(originalText); // 'my message'
 ```
@@ -122,9 +134,9 @@
 // Encrypt
-var ciphertext = CryptoJS.AES.encrypt(JSON.stringify(data), 'secret key 123');
+var ciphertext = CryptoJS.AES.encrypt(JSON.stringify(data), 'secret key 123').toString();
 
 // Decrypt
-var bytes  = CryptoJS.AES.decrypt(ciphertext.toString(), 'secret key 123');
+var bytes  = CryptoJS.AES.decrypt(ciphertext, 'secret key 123');
 var decryptedData = JSON.parse(bytes.toString(CryptoJS.enc.Utf8));
 
-console.log(decryptedData);
+console.log(decryptedData); // [{id: 1}, {id: 2}]
 ```
@@ -131,0 +143,0 @@

sha3.js

@@ -176,2 +176,5 @@ ;(function (root, factory, undef) {
 	                for (var laneIndex = 1; laneIndex < 25; laneIndex++) {
+	                    var tMsw;
+	                    var tLsw;
+
 	                    // Shortcuts
@@ -185,7 +188,7 @@ var lane = state[laneIndex];
 	                    if (rhoOffset < 32) {
-	                        var tMsw = (laneMsw << rhoOffset) | (laneLsw >>> (32 - rhoOffset));
-	                        var tLsw = (laneLsw << rhoOffset) | (laneMsw >>> (32 - rhoOffset));
+	                        tMsw = (laneMsw << rhoOffset) | (laneLsw >>> (32 - rhoOffset));
+	                        tLsw = (laneLsw << rhoOffset) | (laneMsw >>> (32 - rhoOffset));
 	                    } else /* if (rhoOffset >= 32) */ {
-	                        var tMsw = (laneLsw << (rhoOffset - 32)) | (laneMsw >>> (64 - rhoOffset));
-	                        var tLsw = (laneMsw << (rhoOffset - 32)) | (laneLsw >>> (64 - rhoOffset));
+	                        tMsw = (laneLsw << (rhoOffset - 32)) | (laneMsw >>> (64 - rhoOffset));
+	                        tLsw = (laneMsw << (rhoOffset - 32)) | (laneLsw >>> (64 - rhoOffset));
 	                    }
@@ -225,3 +228,3 @@
 	                lane.high ^= roundConstant.high;
-	                lane.low  ^= roundConstant.low;;
+	                lane.low  ^= roundConstant.low;
 	            }
@@ -228,0 +231,0 @@ },

sha512.js

@@ -145,2 +145,5 @@ ;(function (root, factory, undef) {
 	            for (var i = 0; i < 80; i++) {
+	                var Wil;
+	                var Wih;
+
 	                // Shortcut
@@ -151,4 +154,4 @@ var Wi = W[i];
 	                if (i < 16) {
-	                    var Wih = Wi.high = M[offset + i * 2]     | 0;
-	                    var Wil = Wi.low  = M[offset + i * 2 + 1] | 0;
+	                    Wih = Wi.high = M[offset + i * 2]     | 0;
+	                    Wil = Wi.low  = M[offset + i * 2 + 1] | 0;
 	                } else {
@@ -178,8 +181,8 @@ // Gamma0
 
-	                    var Wil = gamma0l + Wi7l;
-	                    var Wih = gamma0h + Wi7h + ((Wil >>> 0) < (gamma0l >>> 0) ? 1 : 0);
-	                    var Wil = Wil + gamma1l;
-	                    var Wih = Wih + gamma1h + ((Wil >>> 0) < (gamma1l >>> 0) ? 1 : 0);
-	                    var Wil = Wil + Wi16l;
-	                    var Wih = Wih + Wi16h + ((Wil >>> 0) < (Wi16l >>> 0) ? 1 : 0);
+	                    Wil = gamma0l + Wi7l;
+	                    Wih = gamma0h + Wi7h + ((Wil >>> 0) < (gamma0l >>> 0) ? 1 : 0);
+	                    Wil = Wil + gamma1l;
+	                    Wih = Wih + gamma1h + ((Wil >>> 0) < (gamma1l >>> 0) ? 1 : 0);
+	                    Wil = Wil + Wi16l;
+	                    Wih = Wih + Wi16h + ((Wil >>> 0) < (Wi16l >>> 0) ? 1 : 0);
 
@@ -186,0 +189,0 @@ Wi.high = Wih;

tripledes.js

@@ -730,7 +730,16 @@ ;(function (root, factory, undef) {
 	            var keyWords = key.words;
+	            // Make sure the key length is valid (64, 128 or >= 192 bit)
+	            if (keyWords.length !== 2 && keyWords.length !== 4 && keyWords.length < 6) {
+	                throw new Error('Invalid key length - 3DES requires the key length to be 64, 128, 192 or >192.');
+	            }
 
+	            // Extend the key according to the keying options defined in 3DES standard
+	            var key1 = keyWords.slice(0, 2);
+	            var key2 = keyWords.length < 4 ? keyWords.slice(0, 2) : keyWords.slice(2, 4);
+	            var key3 = keyWords.length < 6 ? keyWords.slice(0, 2) : keyWords.slice(4, 6);
+
 	            // Create DES instances
-	            this._des1 = DES.createEncryptor(WordArray.create(keyWords.slice(0, 2)));
-	            this._des2 = DES.createEncryptor(WordArray.create(keyWords.slice(2, 4)));
-	            this._des3 = DES.createEncryptor(WordArray.create(keyWords.slice(4, 6)));
+	            this._des1 = DES.createEncryptor(WordArray.create(key1));
+	            this._des2 = DES.createEncryptor(WordArray.create(key2));
+	            this._des3 = DES.createEncryptor(WordArray.create(key3));
 	        },
@@ -737,0 +746,0 @@

New alerts

Deprecated

Maintenance

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Found 1 instance in 1 package

Fixed alerts

No v1

Quality

Package is not semver >=1. This means it is not stable and does not support ^ ranges.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

431743

increased by0.7%

Lines of code

11264

increased by0.55%

Number of low quality alerts

0

decreased by-100%

Number of lines in readme file

211

increased by6.03%

Worsened metrics

Number of high maintenance alerts

1

increased byInfinity%

No dependency changes