oauth-1.0a - npm Package Compare versions

Comparing version 0.0.8 to 0.1.0

test/options/consumer.js

+var expect;
+
+//Node.js
+if(typeof(module) !== 'undefined' && typeof(exports) !== 'undefined') {
+    expect = require('chai').expect;
+    var OAuth = require('../../oauth-1.0a');
+} else { //Browser
+    expect = chai.expect;
+}
+
+//TODO: check alphabet and numberic only
+
+describe("consumer option", function() {
+    describe("required option", function() {
+        it("should throw error on undefined", function() {
+            expect(function() {
+                oauth = OAuth();
+            }).to.throw('consumer option is required');
+        });
+    });
+});

test/options/last_ampersand.js

+var expect;
+
+//Node.js
+if(typeof(module) !== 'undefined' && typeof(exports) !== 'undefined') {
+    expect = require('chai').expect;
+    var OAuth = require('../../oauth-1.0a');
+} else { //Browser
+    expect = chai.expect;
+}
+
+describe("last_ampersand option", function() {
+    
+    describe("default (true)", function() {
+        var oauth = OAuth({
+            consumer: {
+                secret: 'kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw'
+            }
+        });
+
+        var token = {
+            secret: 'LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE'
+        };
+
+        it("should be equal to Twitter example", function() {
+            expect(oauth.getSigningKey(token.secret)).to.equal('kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw&LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE');
+        });
+
+        it("should has the ampersand at the end", function() {
+            expect(oauth.getSigningKey()).to.equal('kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw&');
+        });
+    });
+
+    describe("change to false", function() {
+        var oauth = OAuth({
+            consumer: {
+                secret: 'kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw'
+            },
+            last_ampersand: false
+        });
+
+        var token = {
+            secret: 'LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE'
+        };
+
+        it("should be equal to Twitter example", function() {
+            expect(oauth.getSigningKey(token.secret)).to.equal('kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw&LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE');
+        });
+
+        it("should not has the ampersand at the end", function() {
+            expect(oauth.getSigningKey()).to.equal('kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw');
+        });
+    });
+});

test/options/nonce_length.js

+var expect;
+
+//Node.js
+if(typeof(module) !== 'undefined' && typeof(exports) !== 'undefined') {
+    expect = require('chai').expect;
+    var OAuth = require('../../oauth-1.0a');
+} else { //Browser
+    expect = chai.expect;
+}
+
+//TODO: check alphabet and numberic only
+
+describe("nonce_length option", function() {
+    describe("default (32)", function() {
+        var oauth = OAuth({
+            consumer: {}
+        });
+
+        it("nonce length should be 32", function() {
+            expect(oauth.getNonce().length).to.equal(32);
+        });
+    });
+
+    describe("length 100", function() {
+        var oauth = OAuth({
+            consumer: {},
+            nonce_length: 100
+        });
+
+        it("nonce length should be 100", function() {
+            expect(oauth.getNonce().length).to.equal(100);
+        });
+    });
+
+    describe("random length", function() {
+        var random = parseInt(Math.random()*100, 10);
+
+        var oauth = new OAuth({
+            consumer: {},
+            nonce_length: random
+        });
+
+        it("nonce length should be correct", function() {
+            expect(oauth.getNonce().length).to.equal(random);
+        });
+    });
+});

test/options/parameter_seperator.js

+var expect;
+
+//Node.js
+if(typeof(module) !== 'undefined' && typeof(exports) !== 'undefined') {
+    expect = require('chai').expect;
+    var OAuth = require('../../oauth-1.0a');
+} else { //Browser
+    expect = chai.expect;
+}
+
+describe("parameter_seperator option", function() {
+    describe("default (', ')", function() {
+        var oauth = OAuth({
+            consumer: {
+                public: 'xvz1evFS4wEEPTGEFPHBog',
+                secret: 'kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw'
+            }
+        });
+
+        //overide for testing only !!!
+        oauth.getTimeStamp = function() {
+            return 1318622958;
+        };
+
+        //overide for testing only !!!
+        oauth.getNonce = function(length) {
+            return 'kYjzVBB8Y0ZFabxSWbWovY3uYSQ2pTgmZeNu2VS4cg';
+        };
+        
+        var token = {
+            public: '370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb',
+            secret: 'LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE'
+        };
+
+        var request = {
+            url: 'https://api.twitter.com/1/statuses/update.json?include_entities=true',
+            method: 'POST',
+            data: {
+                status: 'Hello Ladies + Gentlemen, a signed OAuth request!'
+            }
+        };
+
+        it("should be equal to Twitter example", function() {
+            expect(oauth.toHeader(oauth.authorize(request, token))).to.have.property('Authorization', 'OAuth oauth_consumer_key="xvz1evFS4wEEPTGEFPHBog", oauth_nonce="kYjzVBB8Y0ZFabxSWbWovY3uYSQ2pTgmZeNu2VS4cg", oauth_signature="tnnArxj06cWHq44gCs1OSKk%2FjLY%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1318622958", oauth_token="370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb", oauth_version="1.0"');
+        });
+    });
+
+    describe("-", function() {
+        var oauth = OAuth({
+            consumer: {
+                public: 'xvz1evFS4wEEPTGEFPHBog',
+                secret: 'kAcSOqF21Fu85e7zjz7ZN2U4ZRhfV3WpwPAoE3Z7kBw'
+            },
+            parameter_seperator: '-'
+        });
+
+        //overide for testing only !!!
+        oauth.getTimeStamp = function() {
+            return 1318622958;
+        };
+
+        //overide for testing only !!!
+        oauth.getNonce = function(length) {
+            return 'kYjzVBB8Y0ZFabxSWbWovY3uYSQ2pTgmZeNu2VS4cg';
+        };
+
+        var token = {
+            public: '370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb',
+            secret: 'LswwdoUaIvS8ltyTt5jkRh4J50vUPVVHtR2YPi5kE'
+        };
+
+        var request = {
+            url: 'https://api.twitter.com/1/statuses/update.json?include_entities=true',
+            method: 'POST',
+            data: {
+                status: 'Hello Ladies + Gentlemen, a signed OAuth request!'
+            }
+        };
+
+        it("header should be correct", function() {
+            expect(oauth.toHeader(oauth.authorize(request, token))).to.have.property('Authorization', 'OAuth oauth_consumer_key="xvz1evFS4wEEPTGEFPHBog"-oauth_nonce="kYjzVBB8Y0ZFabxSWbWovY3uYSQ2pTgmZeNu2VS4cg"-oauth_signature="tnnArxj06cWHq44gCs1OSKk%2FjLY%3D"-oauth_signature_method="HMAC-SHA1"-oauth_timestamp="1318622958"-oauth_token="370773112-GmHxMAgYyLbNEtIKZeRNFsMKPR9EyMZeS9weJAEb"-oauth_version="1.0"');
+        });
+    });
+});
+
+function generateTest(options) {
+    var oauth = new OAuth(options);
+
+    //overide for testing only !!!
+    oauth.getTimeStamp = function() {
+        return 1318622958;
+    };
+
+    //overide for testing only !!!
+    oauth.getNonce = function(length) {
+        return 'kYjzVBB8Y0ZFabxSWbWovY3uYSQ2pTgmZeNu2VS4cg';
+    };
+
+    return oauth;
+}

test/options/signature_method.js

+var expect;
+
+//Node.js
+if(typeof(module) !== 'undefined' && typeof(exports) !== 'undefined') {
+    expect = require('chai').expect;
+    var OAuth = require('../../oauth-1.0a');
+} else { //Browser
+    expect = chai.expect;
+}
+
+describe("Signature method", function() {
+    describe("PLAINTEXT signature method", function() {
+        var oauth = new OAuth({
+            consumer: {},
+            signature_method: 'PLAINTEXT'
+        });
+
+        it("hash should be return key only", function() {
+            expect(oauth.hash('base_string', 'key')).to.equal('key');
+        });
+    });
+
+    describe("RSA-SHA1 signature method", function() {
+        it("constructor should throw a error", function() {
+            expect(function() {
+                OAuth({
+                    consumer: {},
+                    signature_method: 'RSA-SHA1'
+                });
+            }).to.throw('oauth-1.0a does not support this signature method right now. Coming Soon...');
+        });
+    });
+
+    describe("UNKNOWN signature method", function() {
+        it("constructor should throw a error", function() {
+            expect(function() {
+                new OAuth({
+                    consumer: {},
+                    signature_method: 'UNKNOWN'
+                });
+            }).to.throw('The OAuth 1.0a protocol defines three signature methods: HMAC-SHA1, RSA-SHA1, and PLAINTEXT only');
+        });
+    });
+});

bower.json

 {
   "name": "oauth-1.0a",
   "main": "oauth-1.0a.js",
-  "version": "0.0.8",
+  "version": "0.1.0",
   "homepage": "https://github.com/ddo/oauth-1.0a",
@@ -6,0 +6,0 @@ "authors": [

component.json

@@ -5,3 +5,3 @@ {
   "description": "OAuth 1.0a Request Authorization for Node and Browser",
-  "version": "0.0.8",
+  "version": "0.1.0",
   "keywords": [
@@ -8,0 +8,0 @@ "oauth",

oauth-1.0a.js

@@ -15,5 +15,22 @@ if (typeof(module) !== 'undefined' && typeof(exports) !== 'undefined') {
 
-    this.consumer = opts.consumer;
-    this.signature_method = opts.signature_method || 'HMAC-SHA1';
+    if(!opts) {
+        opts = {};
+    }
 
+    if(!opts.consumer) {
+        throw new Error('consumer option is required');
+    }
+
+    this.consumer            = opts.consumer;
+    this.signature_method    = opts.signature_method || 'HMAC-SHA1';
+    this.nonce_length        = opts.nonce_length || 32;
+    this.version             = opts.version || '1.0';
+    this.parameter_seperator = opts.parameter_seperator || ', ';
+
+    if(typeof opts.last_ampersand === 'undefined') {
+        this.last_ampersand = true;
+    } else {
+        this.last_ampersand = opts.last_ampersand;
+    }
+
     switch (this.signature_method) {
@@ -32,6 +49,4 @@ case 'HMAC-SHA1':
             throw new Error('oauth-1.0a does not support this signature method right now. Coming Soon...');
-            break;
         default:
             throw new Error('The OAuth 1.0a protocol defines three signature methods: HMAC-SHA1, RSA-SHA1, and PLAINTEXT only');
-            break;
     }
@@ -57,10 +72,12 @@ }
         oauth_timestamp: this.getTimeStamp(),
-        oauth_version: '1.0'
+        oauth_version: this.version
     };
 
-    if (!token)
+    if(!token) {
         token = {};
+    }
 
-    if (token.public)
+    if(token.public) {
         oauth_data.oauth_token = token.public;
+    }
 
@@ -109,3 +126,3 @@ oauth_data.oauth_signature = this.getSignature(request, token.secret, oauth_data);
     //base_string_data to string
-    for (var key in base_string_data) {
+    for(var key in base_string_data) {
         data_str += key + '=' + base_string_data[key] + '&';
@@ -126,2 +143,7 @@ }
     token_secret = token_secret || '';
+
+    if(!this.last_ampersand && !token_secret) {
+        return this.percentEncode(this.consumer.secret);
+    }
+
     return this.percentEncode(this.consumer.secret) + '&' + this.percentEncode(token_secret);
@@ -148,3 +170,3 @@ };
 
-    for (var i = 0; i < arr.length; i++) {
+    for(var i = 0; i < arr.length; i++) {
         var item = arr[i].split('=');
@@ -192,3 +214,3 @@ data[item[0]] = item[1];
 
-    for (var key in data) {
+    for(var key in data) {
         result[this.percentEncode(key)] = this.percentEncode(data[key]);
@@ -210,10 +232,10 @@ }
 
-    for (var key in oauth_data) {
+    for(var key in oauth_data) {
         if (key.indexOf('oauth_') === -1)
             continue;
-        header_value += this.percentEncode(key) + '="' + this.percentEncode(oauth_data[key]) + '", ';
+        header_value += this.percentEncode(key) + '="' + this.percentEncode(oauth_data[key]) + '"' + this.parameter_seperator;
     }
 
     return {
-        Authorization: header_value.substr(0, header_value.length - 2) //cut the last 2 chars
+        Authorization: header_value.substr(0, header_value.length - this.parameter_seperator.length) //cut the last chars
     };
@@ -224,12 +246,9 @@ };
  * Create a random word characters string with input length
- * @param  {Int} length (Default: 32)
  * @return {String} a random word characters string
  */
-OAuth.prototype.getNonce = function(length) {
-    length = length || 32;
-
+OAuth.prototype.getNonce = function() {
     var word_characters = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
     var result = '';
 
-    for (var i = 0; i < length; i++) {
+    for(var i = 0; i < this.nonce_length; i++) {
         result += word_characters[parseInt(Math.random() * word_characters.length, 10)];
@@ -259,3 +278,3 @@ }
     var merged_obj = obj1;
-    for (var key in obj2) {
+    for(var key in obj2) {
         merged_obj[key] = obj2[key];
@@ -277,3 +296,3 @@ }
 
-    for (var i = 0; i < keys.length; i++) {
+    for(var i = 0; i < keys.length; i++) {
         var key = keys[i];
@@ -280,0 +299,0 @@ result[key] = data[key];

package.json

 {
   "name": "oauth-1.0a",
-  "version": "0.0.8",
+  "version": "0.1.0",
   "description": "OAuth 1.0a Request Authorization for Node and Browser.",
@@ -5,0 +5,0 @@ "scripts": {

README.md

@@ -27,8 +27,7 @@ oauth-1.0a
 ```js
-var oauth = new OAuth({
+var oauth = OAuth({
     consumer: {
         public: '<your consumer key>',
         secret: '<your consumer secret>'
-    },
-    signature_method: '<signature method>' //HMAC-SHA1 or PLAINTEXT ...
+    }
 });
@@ -54,3 +53,3 @@ ```
 ###Browser
-Download oauth-1.0a.js [here](https://github.com/ddo/oauth-1.0a/blob/0.0.8/oauth-1.0a.js)
+Download oauth-1.0a.js [here](https://github.com/ddo/oauth-1.0a/blob/0.1.0/oauth-1.0a.js)
 
@@ -74,3 +73,3 @@ <script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/hmac-sha1.js"></script>
 ```js
-var oauth = new OAuth({
+var oauth = OAuth({
     consumer: {
@@ -134,3 +133,3 @@ public: 'xvz1evFS4wEEPTGEFPHBog',
 ```js
-var oauth = new OAuth({
+var oauth = OAuth({
     consumer: {
@@ -187,2 +186,25 @@ public: 'xvz1evFS4wEEPTGEFPHBog',
 ```
+
+##Options
+```js
+var oauth = OAuth(/* options */);
+```
+
+* ``consumer``: ``Object`` ``Required`` your consumer keys
+
+```js
+{
+    public: <your consumer key>,
+    secret: <your consumer secret>
+}
+```
+
+* ``signature_method``: ``String`` default ``'HMAC-SHA1'``
+* ``nonce_length``: ``Int`` default ``32``
+* ``version``: ``String`` default ``'1.0'``
+* ``parameter_seperator``: ``String`` for header only, default ``', '``. Note that there is a space after ``,``
+* ``last_ampersand``: ``Bool`` default ``true``. For some services if there is no Token Secret then no need ``&`` at the end. Check [oauth doc](http://oauth.net/core/1.0a/#anchor22) for more information
+
+> oauth_signature is set to the concatenated encoded values of the Consumer Secret and Token Secret, separated by a '&' character (ASCII code 38), even if either secret is empty
+
 ##Notes
@@ -189,0 +211,0 @@

test/index.js

-var expect;
-
-//Node.js
-if(typeof(module) !== 'undefined' && typeof(exports) !== 'undefined') {
-    expect = require('chai').expect;
-    var OAuth = require('../oauth-1.0a');
-} else { //Browser
-    expect = chai.expect;
-}
-
-describe("Signature method", function() {
-    describe("PLAINTEXT signature method", function() {
-        var oauth = new OAuth({
-            signature_method: 'PLAINTEXT'
-        });
-
-        it("hash should be return key only", function() {
-            expect(oauth.hash('base_string', 'key')).to.equal('key');
-        });
-    });
-
-    describe("RSA-SHA1 signature method", function() {
-        it("constructor should throw a error", function() {
-            expect(function() {
-                OAuth({
-                    signature_method: 'RSA-SHA1'
-                });
-            }).to.throw('oauth-1.0a does not support this signature method right now. Coming Soon...');
-        });
-    });
-
-    describe("UNKNOWN signature method", function() {
-        it("constructor should throw a error", function() {
-            expect(function() {
-                new OAuth({
-                    signature_method: 'UNKNOWN'
-                });
-            }).to.throw('The OAuth 1.0a protocol defines three signature methods: HMAC-SHA1, RSA-SHA1, and PLAINTEXT only');
-        });
-    });
-});

New alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 13 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Dynamic require

Supply chain risk

Dynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 13 instances in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

634875

1.35%

Number of package files

39

11.43%

Lines of code

19730

1.01%

Number of lines in readme file

269

8.91%

No dependency changes