jsonld-signatures - npm Package Compare versions

Comparing version 2.1.0 to 2.1.1

CHANGELOG.md

 # jsonld-signatures ChangeLog
 
+## 2.1.1 - 2018-02-14
+
+### Fixed
+- Ensure proof node is sanitized prior to use as verification
+  data.
+- Expose `sanitizeProofNode` for suite-specific override.
+
 ## 2.1.0 - 2018-02-14
@@ -4,0 +11,0 @@

dist/node6/lib/suites/LinkedDataSignature.js

@@ -63,5 +63,4 @@ /*
 
-      // `jws` must not be included in the proof options
-      const proof = util.deepClone(options.proof);
-      delete proof.jws;
+      // ensure signature values are removed from proof node
+      const proof = yield _this2.sanitizeProofNode(options.proof, options);
 
@@ -78,2 +77,14 @@ // concatenate hash of c14n proof options and hash of c14n document
 
+  sanitizeProofNode(proof, options) {
+    return _asyncToGenerator(function* () {
+      // `jws`,`signatureValue`,`proofValue` must not be included in the proof
+      // options
+      proof = util.deepClone(options.proof);
+      delete proof.jws;
+      delete proof.signatureValue;
+      delete proof.proofValue;
+      return proof;
+    })();
+  }
+
   sign(input, options) {
@@ -80,0 +91,0 @@ var _this3 = this;

lib/suites/LinkedDataSignature.js

@@ -55,5 +55,4 @@ /*
 
-    // `jws` must not be included in the proof options
-    const proof = util.deepClone(options.proof);
-    delete proof.jws;
+    // ensure signature values are removed from proof node
+    const proof = await this.sanitizeProofNode(options.proof, options);
 
@@ -70,2 +69,12 @@ // concatenate hash of c14n proof options and hash of c14n document
 
+  async sanitizeProofNode(proof, options) {
+    // `jws`,`signatureValue`,`proofValue` must not be included in the proof
+    // options
+    proof = util.deepClone(options.proof);
+    delete proof.jws;
+    delete proof.signatureValue;
+    delete proof.proofValue;
+    return proof;
+  }
+
   async sign(input, options) {
@@ -72,0 +81,0 @@ // copy options for setting defaults

package.json

 {
   "name": "jsonld-signatures",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "An implementation of the Linked Data Signatures specifications for JSON-LD in JavaScript.",
@@ -5,0 +5,0 @@ "homepage": "https://github.com/digitalbazaar/jsonld-signatures",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

396649

increased by0.56%

Lines of code

7636

increased by0.61%

No dependency changes