node-forge - npm Package Compare versions

Comparing version 0.2.8 to 0.2.9

js/prng.js

@@ -248,21 +248,38 @@ /**
   function defaultSeedFile(needed) {
-    // use window.crypto.getRandomValues strong source of entropy if
-    // available
+    // use window.crypto.getRandomValues strong source of entropy if available
+    var getRandomValues = null;
+    if(typeof window !== 'undefined') {
+      if(window.crypto && window.crypto.getRandomValues) {
+        getRandomValues = function(arr) {
+          return window.crypto.getRandomValues(arr);
+        };
+      }
+      else if(window.msCrypto && window.msCrypto.getRandomValues) {
+        getRandomValues = function(arr) {
+          return window.msCrypto.getRandomValues(arr);
+        };
+      }
+    }
+
     var b = forge.util.createBuffer();
-    if(typeof window !== 'undefined' &&
-      window.crypto && window.crypto.getRandomValues) {
-      var entropy = new Uint32Array(needed / 4);
-      try {
-        window.crypto.getRandomValues(entropy);
-        for(var i = 0; i < entropy.length; ++i) {
-          b.putInt32(entropy[i]);
+    if(getRandomValues) {
+      while(b.length() < needed) {
+        // max byte length is 65536 before QuotaExceededError is thrown
+        // http://www.w3.org/TR/WebCryptoAPI/#RandomSource-method-getRandomValues
+        var count = Math.max(1, Math.min(needed - b.length(), 65536) / 4);
+        var entropy = new Uint32Array(Math.floor(count));
+        try {
+          getRandomValues(entropy);
+          for(var i = 0; i < entropy.length; ++i) {
+            b.putInt32(entropy[i]);
+          }
         }
+        catch(e) {
+          /* only ignore QuotaExceededError */
+          if(!(typeof QuotaExceededError !== 'undefined' &&
+            e instanceof QuotaExceededError)) {
+            throw e;
+          }
+        }
       }
-      catch(e) {
-        /* Mozilla claims getRandomValues can throw QuotaExceededError, so
-         ignore errors. In this case, weak entropy will be added, but
-         hopefully this never happens.
-         https://developer.mozilla.org/en-US/docs/DOM/window.crypto.getRandomValues
-         However I've never observed this exception --@evanj */
-      }
     }
@@ -295,3 +312,3 @@
 
-    return b.getBytes();
+    return b.getBytes(needed);
   }
@@ -298,0 +315,0 @@ // initialize seed file APIs

package.json

 {
   "name": "node-forge",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilties.",
@@ -5,0 +5,0 @@ "homepage": "http://github.com/digitalbazaar/forge",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

2143875

increased by0.02%

Lines of code

34880

increased by0.05%

No dependency changes