jws - npm Package Compare versions

Comparing version 3.1.0 to 3.1.1

lib/data-stream.js

@@ -7,13 +7,25 @@ /*global module, process*/
 function DataStream(data) {
-  this.buffer = Buffer(data||0);
+  this.buffer = null;
   this.writable = true;
   this.readable = true;
-  if (!data)
+
+  // No input
+  if (!data) {
+    this.buffer = new Buffer(0);
     return this;
-  if (typeof data.pipe === 'function')
+  }
+
+  // Stream
+  if (typeof data.pipe === 'function') {
+    this.buffer = new Buffer(0);
     data.pipe(this);
-  else if (data.length) {
+    return this;
+  }
+
+  // Buffer or String
+  // or Object (assumedly a passworded key)
+  if (data.length || typeof data === 'object') {
+    this.buffer = data;
     this.writable = false;
     process.nextTick(function () {
-      this.buffer = data;
       this.emit('end', data);
@@ -23,3 +35,6 @@ this.readable = false;
     }.bind(this));
+    return this;
   }
+
+  throw new TypeError('Unexpected data type ('+ typeof data + ')');
 }
@@ -26,0 +41,0 @@ util.inherits(DataStream, Stream);

lib/sign-stream.js

@@ -48,13 +48,19 @@ /*global module*/
 SignStream.prototype.sign = function sign() {
-  const signature = jwsSign({
-    header: this.header,
-    payload: this.payload.buffer,
-    secret: this.secret.buffer,
-    encoding: this.encoding
-  });
-  this.emit('done', signature);
-  this.emit('data', signature);
-  this.emit('end');
-  this.readable = false;
-  return signature;
+  try {
+    const signature = jwsSign({
+      header: this.header,
+      payload: this.payload.buffer,
+      secret: this.secret.buffer,
+      encoding: this.encoding
+    });
+    this.emit('done', signature);
+    this.emit('data', signature);
+    this.emit('end');
+    this.readable = false;
+    return signature;
+  } catch (e) {
+    this.readable = false;
+    this.emit('error', e);
+    this.emit('close');
+  }
 };
@@ -61,0 +67,0 @@

lib/verify-stream.js

@@ -101,9 +101,15 @@ /*global module*/
 VerifyStream.prototype.verify = function verify() {
-  const valid = jwsVerify(this.signature.buffer, this.algorithm, this.key.buffer);
-  const obj = jwsDecode(this.signature.buffer, this.encoding);
-  this.emit('done', valid, obj);
-  this.emit('data', valid);
-  this.emit('end');
-  this.readable = false;
-  return valid;
+  try {
+    const valid = jwsVerify(this.signature.buffer, this.algorithm, this.key.buffer);
+    const obj = jwsDecode(this.signature.buffer, this.encoding);
+    this.emit('done', valid, obj);
+    this.emit('data', valid);
+    this.emit('end');
+    this.readable = false;
+    return valid;
+  } catch (e) {
+    this.readable = false;
+    this.emit('error', e);
+    this.emit('close');
+  }
 };
@@ -110,0 +116,0 @@

package.json

 {
   "name": "jws",
-  "version": "3.1.0",
+  "version": "3.1.1",
   "description": "Implementation of JSON Web Signatures",
@@ -31,4 +31,5 @@ "main": "index.js",
   "devDependencies": {
+    "semver": "^5.1.0",
     "tape": "~2.14.0"
   }
 }

readme.md

@@ -103,2 +103,4 @@ # node-jws [![Build Status](https://secure.travis-ci.org/brianloveswords/node-jws.png)](http://travis-ci.org/brianloveswords/node-jws)
 value is known ahead of time, or a stream for convenience.
+`key`/`privateKey`/`secret` may also be an object when using an encrypted
+private key, see the [crypto documentation][encrypted-key-docs].
 
@@ -246,1 +248,3 @@ Example
 ```
+
+[encrypted-key-docs]: https://nodejs.org/api/crypto.html#crypto_sign_sign_private_key_output_format

test/jws.test.js

@@ -7,2 +7,5 @@ /*global process*/
 
+const NODE_VERSION = require('semver').clean(process.version);
+const SUPPORTS_ENCRYPTED_KEYS = require('semver').gte(NODE_VERSION, '0.11.8');
+
 function readfile(path) {
@@ -17,2 +20,4 @@ return fs.readFileSync(__dirname + '/' + path).toString();
 const rsaPrivateKey = readfile('rsa-private.pem');
+const rsaPrivateKeyEncrypted = readfile('rsa-private-encrypted.pem');
+const encryptedPassphrase = readfile('encrypted-key-passphrase');
 const rsaPublicKey = readfile('rsa-public.pem');
@@ -63,3 +68,2 @@ const rsaWrongPublicKey = readfile('rsa-wrong-public.pem');
     t.notOk(jws.verify(jwsObj, alg, 'something else'), 'should not verify with non-matching secret');
-    t.notOk(jws.verify(jwsObj, 'RS'+bits, secret), 'should not verify with non-matching algorithm');
     t.same(parts.payload, payload, 'should match payload');
@@ -225,2 +229,55 @@ t.same(parts.header, header, 'should match header');
 
+test('Streaming verify: errors during verify should emit as "error"', function (t) {
+  const verifierShouldError = jws.createVerify({
+    algorithm: 'ES512',
+    signature: 'a.b.c', // the short/invalid length signature will make jwa throw
+    publicKey: 'invalid-key-will-make-crypto-throw'
+  });
+
+  verifierShouldError.on('done', function () {
+    t.fail();
+    t.end();
+  });
+  verifierShouldError.on('error', function () {
+    t.end()
+  });
+});
+
+if (SUPPORTS_ENCRYPTED_KEYS) {
+  test('Signing: should accept an encrypted key', function (t) {
+    const alg = 'RS256';
+    const signature = jws.sign({
+      header: { alg: alg },
+      payload: 'verifyme',
+      privateKey: {
+        key: rsaPrivateKeyEncrypted,
+        passphrase: encryptedPassphrase
+      }
+    });
+    t.ok(jws.verify(signature, 'RS256', rsaPublicKey));
+    t.end();
+  });
+
+  test('Streaming sign: should accept an encrypted key', function (t) {
+    const alg = 'RS256';
+    const signer = jws.createSign({
+      header: { alg: alg },
+      payload: 'verifyme',
+      privateKey: {
+        key: rsaPrivateKeyEncrypted,
+        passphrase: encryptedPassphrase
+      }
+    });
+    const verifier = jws.createVerify({
+      algorithm: alg,
+      signature: signer,
+      publicKey: rsaPublicKey
+    });
+    verifier.on('done', function (verified) {
+      t.ok(verified);
+      t.end();
+    });
+  });
+}
+
 test('jws.decode: not a jws signature', function (t) {
@@ -227,0 +284,0 @@ t.same(jws.decode('some garbage string'), null);

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

29437

9.52%

Lines of code

534

16.34%

Number of lines in readme file

249

1.63%

Number of medium supply chain risk alerts

0

-100%

Worsened metrics

Dev dependency count

2

100%

No dependency changes