node-oauth1 - npm Package Compare versions

Comparing version 1.2.4 to 1.3.0

index.js

@@ -75,3 +75,3 @@ /* jshint ignore:start */
  */
-var CryptoJS = require('crypto-js');
+var crypto = require('crypto');
 
@@ -403,2 +403,7 @@ var OAuth;
         initialize: function initialize(name, accessor) {
+            if (name.startsWith("RSA")) {
+                this.key = accessor.privateKey;
+                return;
+            }
+
             var consumerSecret;
@@ -441,3 +446,3 @@ if (accessor.accessorSecret != null
             }
-            var err = new Error("signature_method_rejected");
+            var err = new Error("Unsupported signature method");
             var acceptable = "";
@@ -573,5 +578,3 @@ for (var r in OAuth.SignatureMethod.REGISTERED) {
         function getSignature(baseString) {
-            b64pad = '=';
-            var signature = CryptoJS.HmacSHA1(baseString, this.key).toString(CryptoJS.enc.Base64);
-            return signature;
+            return crypto.createHmac('sha1', this.key).update(baseString).digest('base64');
         }
@@ -583,8 +586,34 @@ ));
         function getSignature(baseString) {
-            b64pad = '=';
-            var signature = CryptoJS.HmacSHA256(baseString, this.key).toString(CryptoJS.enc.Base64);
-            return signature;
+            return crypto.createHmac('sha256', this.key).update(baseString).digest('base64');
         }
     ));
 
+OAuth.SignatureMethod.registerMethodClass(["HMAC-SHA512", "HMAC-SHA512-Accessor"],
+    OAuth.SignatureMethod.makeSubclass(
+        function getSignature(baseString) {
+            return crypto.createHmac('sha512', this.key).update(baseString).digest('base64');
+        }
+    ));
+
+OAuth.SignatureMethod.registerMethodClass(["RSA-SHA1", "RSA-SHA1-Accessor"],
+    OAuth.SignatureMethod.makeSubclass(
+        function getSignature(baseString) {
+            return crypto.createSign('RSA-SHA1').update(baseString).sign(this.key, 'base64');
+        }
+    ));
+
+OAuth.SignatureMethod.registerMethodClass(["RSA-SHA256", "RSA-SHA256-Accessor"],
+    OAuth.SignatureMethod.makeSubclass(
+        function getSignature(baseString) {
+            return crypto.createSign('RSA-SHA256').update(baseString).sign(this.key, 'base64');
+        }
+    ));
+
+OAuth.SignatureMethod.registerMethodClass(["RSA-SHA512", "RSA-SHA512-Accessor"],
+    OAuth.SignatureMethod.makeSubclass(
+        function getSignature(baseString) {
+            return crypto.createSign('RSA-SHA512').update(baseString).sign(this.key, 'base64');
+        }
+    ));
+
 try {
@@ -591,0 +620,0 @@ OAuth.correctTimestampFromSrc();

package.json

 {
   "name": "node-oauth1",
-  "version": "1.2.4",
+  "version": "1.3.0",
   "description": "A fork of Netflix's implementation of the OAuth1 protocol",
   "main": "index.js",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "npm run test-unit && npm run test-browser",
+    "test-unit": "node npm/test-unit.js",
+    "test-browser": "node npm/test-browser.js"
   },
@@ -24,5 +26,19 @@ "repository": {
   "homepage": "https://github.com/czardoz/node-oauth1#readme",
-  "dependencies": {
-    "crypto-js": "~3.3.0"
+  "dependencies": {},
+  "devDependencies": {
+    "browserify": "16.5.1",
+    "chai": "4.2.0",
+    "chalk": "2.4.2",
+    "colors": "1.4.0",
+    "karma": "3.1.4",
+    "karma-browserify": "6.1.0",
+    "karma-chrome-launcher": "3.1.0",
+    "karma-mocha": "1.3.0",
+    "karma-mocha-reporter": "2.2.5",
+    "mocha": "7.1.2",
+    "nyc": "14.1.1",
+    "puppeteer": "1.20.0",
+    "recursive-readdir": "2.2.2",
+    "shelljs": "0.8.4"
   }
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

No tests

Quality

Package does not have any tests. This is a strong signal of a poorly maintained or low quality package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

48970

increased by101.37%

Dependency count

0

decreased by-100%

Number of package files

10

increased by233.33%

Lines of code

1045

increased by87.28%

Number of low quality alerts

0

decreased by-100%

Worsened metrics

Dev dependency count

14

increased byInfinity%

Number of low supply chain risk alerts

1

increased byInfinity%

Dependency changes

• - Removedcrypto-js@~3.3.0

• - Removedcrypto-js@3.3.0(transitive)