micro-eth-signer - npm Package Compare versions

Comparing version 0.7.0 to 0.7.1

lib/_type_test.js

@@ -65,2 +65,5 @@ "use strict";
 ]));
+assertType(web3.mapArgs([{ type: 'uint32[1][]' }]));
+// zero sized arrays not supported by types
+assertType(web3.mapArgs([{ type: 'uint32[0][]' }]));
 // Without const
@@ -67,0 +70,0 @@ assertType(web3.mapArgs([

lib/esm/_type_test.js

@@ -63,2 +63,5 @@ import * as web3 from './web3.js';
 ]));
+assertType(web3.mapArgs([{ type: 'uint32[1][]' }]));
+// zero sized arrays not supported by types
+assertType(web3.mapArgs([{ type: 'uint32[0][]' }]));
 // Without const
@@ -65,0 +68,0 @@ assertType(web3.mapArgs([

lib/esm/web3.js

@@ -81,7 +81,11 @@ import { keccak_256 } from '@noble/hashes/sha3';
     let m;
-    if ((m = /^(.+)\[(\d+)?]$/.exec(c.type))) {
+    if ((m = ARRAY_RE.exec(c.type))) {
         const inner = mapComponent({ ...c, type: m[1] });
+        if (inner.size === 0)
+            throw new Error('mapComponent: arrays of zero-size elements disabled (possible DoS attack)');
         // Static array
-        if (+m[2]) {
-            let out = P.array(+m[2], inner);
+        if (m[3] !== undefined) {
+            if (!Number.isSafeInteger(+m[3]))
+                throw new Error(`mapComponent: wrong array size=${m[3]}`);
+            let out = P.array(+m[3], inner);
             // Static array of dynamic values should be behind pointer too, again without reason.
@@ -88,0 +92,0 @@ if (inner.size === undefined)

lib/web3.js

@@ -88,7 +88,11 @@ "use strict";
     let m;
-    if ((m = /^(.+)\[(\d+)?]$/.exec(c.type))) {
+    if ((m = ARRAY_RE.exec(c.type))) {
         const inner = mapComponent({ ...c, type: m[1] });
+        if (inner.size === 0)
+            throw new Error('mapComponent: arrays of zero-size elements disabled (possible DoS attack)');
         // Static array
-        if (+m[2]) {
-            let out = P.array(+m[2], inner);
+        if (m[3] !== undefined) {
+            if (!Number.isSafeInteger(+m[3]))
+                throw new Error(`mapComponent: wrong array size=${m[3]}`);
+            let out = P.array(+m[3], inner);
             // Static array of dynamic values should be behind pointer too, again without reason.
@@ -95,0 +99,0 @@ if (inner.size === undefined)

package.json

 {
   "name": "micro-eth-signer",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Small tool for Ethereum transactions, addresses and smart contracts",
@@ -5,0 +5,0 @@ "files": [

src/_type_test.ts

@@ -93,2 +93,5 @@ import * as P from 'micro-packed';
 );
+assertType<P.CoderType<bigint[][]>>(web3.mapArgs([{ type: 'uint32[1][]' }] as const));
+// zero sized arrays not supported by types
+assertType<P.CoderType<unknown>>(web3.mapArgs([{ type: 'uint32[0][]' }] as const));
 // Without const
@@ -95,0 +98,0 @@ assertType<P.CoderType<Record<string, unknown>>>(

src/web3.ts

@@ -195,7 +195,10 @@ import { keccak_256 } from '@noble/hashes/sha3';
   let m;
-  if ((m = /^(.+)\[(\d+)?]$/.exec(c.type))) {
+  if ((m = ARRAY_RE.exec(c.type))) {
     const inner = mapComponent({ ...c, type: m[1] });
+    if (inner.size === 0)
+      throw new Error('mapComponent: arrays of zero-size elements disabled (possible DoS attack)');
     // Static array
-    if (+m[2]) {
-      let out = P.array(+m[2], inner);
+    if (m[3] !== undefined) {
+      if (!Number.isSafeInteger(+m[3])) throw new Error(`mapComponent: wrong array size=${m[3]}`);
+      let out = P.array(+m[3], inner);
       // Static array of dynamic values should be behind pointer too, again without reason.
@@ -202,0 +205,0 @@ if (inner.size === undefined) out = P.pointer(PTR, out);

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

507622

increased by0.25%

Lines of code

10745

increased by0.19%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes