node-forge - npm Package Compare versions

Comparing version 0.1.5 to 0.1.6

js/forge.js

@@ -9,2 +9,3 @@ /**
 (function() {
+var name = 'forge';
 var deps = [
@@ -34,10 +35,8 @@ './aes',
 ];
-var cjsDefine = null;
+var nodeDefine = null;
 if(typeof define !== 'function') {
-  // CommonJS -> AMD
+  // NodeJS -> AMD
   if(typeof module === 'object' && module.exports) {
-    cjsDefine = function(ids, factory) {
-      module.exports = factory.apply(null, ids.map(function(id) {
-        return require(id);
-      }));
+    nodeDefine = function(ids, factory) {
+      factory(require, module);
     };
@@ -48,13 +47,21 @@ }
     if(typeof forge === 'undefined') {
-      forge = {};
+      // set to true to disable native code if even it's available
+      forge = {disableNativeCode: false};
     }
-    initModule(forge);
   }
 }
 // AMD
-if(cjsDefine || typeof define === 'function') {
-  // define module AMD style
-  (cjsDefine || define)(deps, function() {
-    var forge = {};
-    var mods = Array.prototype.slice.call(arguments);
+var defineDeps = ['require', 'module'].concat(deps);
+var defineFunc = function(require, module) {
+  module.exports = function(forge) {
+    var mods = deps.map(function(dep) {
+      return require(dep);
+    });
+    // handle circular dependencies
+    forge = forge || {};
+    forge.defined = forge.defined || {};
+    if(forge.defined[name]) {
+      return forge[name];
+    }
+    forge.defined[name] = true;
     for(var i = 0; i < mods.length; ++i) {
@@ -64,4 +71,15 @@ mods[i](forge);
     return forge;
+  };
+  // set to true to disable native code if even it's available
+  module.exports.disableNativeCode = false;
+  module.exports(module.exports);
+};
+if(nodeDefine) {
+  nodeDefine(defineDeps, defineFunc);
+}
+else if(typeof define === 'function') {
+  define([].concat(defineDeps), function() {
+    defineFunc.apply(null, Array.prototype.slice.call(arguments, 0));
   });
 }
 })();

js/oids.js

@@ -19,10 +19,10 @@ /**
 // Note: md2 & md4 not implemented
-//oids['1.2.840.113549.1.1.2'] = 'md2withRSAEncryption';
-//oids['md2withRSAEncryption'] = '1.2.840.113549.1.1.2';
-//oids['1.2.840.113549.1.1.3'] = 'md4withRSAEncryption';
-//oids['md4withRSAEncryption'] = '1.2.840.113549.1.1.3';
-oids['1.2.840.113549.1.1.4'] = 'md5withRSAEncryption';
-oids['md5withRSAEncryption'] = '1.2.840.113549.1.1.4';
-oids['1.2.840.113549.1.1.5'] = 'sha1withRSAEncryption';
-oids['sha1withRSAEncryption'] = '1.2.840.113549.1.1.5';
+//oids['1.2.840.113549.1.1.2'] = 'md2WithRSAEncryption';
+//oids['md2WithRSAEncryption'] = '1.2.840.113549.1.1.2';
+//oids['1.2.840.113549.1.1.3'] = 'md4WithRSAEncryption';
+//oids['md4WithRSAEncryption'] = '1.2.840.113549.1.1.3';
+oids['1.2.840.113549.1.1.4'] = 'md5WithRSAEncryption';
+oids['md5WithRSAEncryption'] = '1.2.840.113549.1.1.4';
+oids['1.2.840.113549.1.1.5'] = 'sha1WithRSAEncryption';
+oids['sha1WithRSAEncryption'] = '1.2.840.113549.1.1.5';
 oids['1.2.840.113549.1.1.7'] = 'RSAES-OAEP';
@@ -153,2 +153,4 @@ oids['RSAES-OAEP'] = '1.2.840.113549.1.1.7';
 // X.509 extension OIDs
+oids['2.16.840.1.113730.1.1'] = 'nsCertType';
+oids['nsCertType'] = '2.16.840.1.113730.1.1';
 oids['2.5.29.1'] = 'authorityKeyIdentifier'; // deprecated, use .35
@@ -155,0 +157,0 @@ oids['2.5.29.2'] = 'keyAttributes'; // obsolete use .37 or .15

js/prng.js

@@ -17,3 +17,3 @@ /**
 var crypto = null;
-if(_nodejs) {
+if(!forge.disableNativeCode && _nodejs) {
   crypto = require('crypto');
@@ -20,0 +20,0 @@ }

js/random.js

@@ -75,4 +75,4 @@ /**
   typeof process !== 'undefined' && process.versions && process.versions.node);
-if(!_nodejs && !(typeof window !== 'undefined' &&
-  window.crypto && window.crypto.getRandomValues)) {
+if(forge.disableNativeCode || (!_nodejs && !(typeof window !== 'undefined' &&
+  window.crypto && window.crypto.getRandomValues))) {
 
@@ -79,0 +79,0 @@ // if this is a web worker, do not use weak entropy, instead register to

package.json

 {
   "name": "node-forge",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilties.",
@@ -5,0 +5,0 @@ "homepage": "http://github.com/digitalbazaar/forge",

README.md

@@ -55,2 +55,25 @@ # Forge
 ---------------------------------------
+
+If at any time you wish to disable the use of native code, where available,
+for particular forge features like its secure random number generator, you
+may set the ```disableNativeCode``` flag on ```forge``` to ```true```. It
+is not recommended that you set this flag as native code is typically more
+performant and may have stronger security properties. It may be useful to
+set this flag to test certain features that you plan to run in environments
+that are different from your testing environment.
+
+To disable native code when including forge in the browser:
+
+```js
+forge = {disableNativeCode: true};
+// now include other files
+```
+
+To disable native code when using node.js:
+
+```js
+var forge = require('node-forge')({disableNativeCode: true});
+```
+
+---------------------------------------
 ## Transports
@@ -203,3 +226,3 @@
   tlsDataReady: function(connection) {
-    // encrypted data is ready to be sent to the server 
+    // encrypted data is ready to be sent to the server
     var data = connection.tlsData.getBytes();
@@ -232,3 +255,3 @@ socket.write(data, 'binary'); // encoding should be 'binary'
 
-// connect to google.com 
+// connect to google.com
 socket.connect(443, 'google.com');
@@ -329,3 +352,3 @@
 var salt = forge.random.getBytesSync(128);
-var derivedKey = forge.pkcs5.pbkdf2('password', salt, numIterations, 16); 
+var derivedKey = forge.pkcs5.pbkdf2('password', salt, numIterations, 16);
 ```
@@ -433,3 +456,3 @@
 
-// encrypt data with a public key (defaults to RSAES PKCS#1 v1.5) 
+// encrypt data with a public key (defaults to RSAES PKCS#1 v1.5)
 var encrypted = publicKey.encrypt(bytes);
@@ -479,3 +502,3 @@
 
-// gets the issuer (its certificate) for the given certificate 
+// gets the issuer (its certificate) for the given certificate
 var issuerCert = caStore.getIssuer(subjectCert);
@@ -564,3 +587,3 @@
 var salt = forge.random.getBytesSync(128);
-var derivedKey = forge.pkcs5.pbkdf2('password', salt, numIterations, 16); 
+var derivedKey = forge.pkcs5.pbkdf2('password', salt, numIterations, 16);
 ```
@@ -1048,3 +1071,3 @@
     npm install node-forge
-    
+
 You can then use forge as a regular module:
@@ -1051,0 +1074,0 @@

tests/nodejs-create-cert.js

@@ -52,2 +52,11 @@ var forge = require('../js/forge');
 }, {
+  name: 'nsCertType',
+  client: true,
+  server: true,
+  email: true,
+  objsign: true,
+  sslCA: true,
+  emailCA: true,
+  objCA: true
+}, {
   name: 'subjectAltName',
@@ -64,3 +73,3 @@ altNames: [{
 // self-sign certificate
-cert.sign(keys.privateKey);
+cert.sign(keys.privateKey/*, forge.md.sha256.create()*/);
 console.log('Certificate created.');
@@ -67,0 +76,0 @@

tests/nodejs-create-csr.js

@@ -39,3 +39,3 @@ var forge = require('../js/forge');
 // sign certification request
-csr.sign(keys.privateKey);
+csr.sign(keys.privateKey/*, forge.md.sha256.create()*/);
 console.log('Certification request (CSR) created.');
@@ -42,0 +42,0 @@

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1400155

increased by0.31%

Lines of code

31108

increased by0.36%

Number of lines in readme file

1155

increased by2.03%

Worsened metrics

Number of medium supply chain risk alerts

18

increased by5.88%

No dependency changes