openpgp - npm Package Compare versions

Comparing version 3.0.11 to 3.0.12

dist/openpgp.worker.min.js

@@ -1,2 +0,2 @@
-/*! OpenPGP.js v3.0.11 - 2018-05-22 - this is LGPL licensed code, see LICENSE/our website https://openpgpjs.org/ for more information. */
+/*! OpenPGP.js v3.0.12 - 2018-07-02 - this is LGPL licensed code, see LICENSE/our website https://openpgpjs.org/ for more information. */
 !function e(n,t,r){function o(a,f){if(!t[a]){if(!n[a]){var c="function"==typeof require&&require;if(!f&&c)return c(a,!0);if(i)return i(a,!0);var s=new Error("Cannot find module '"+a+"'");throw s.code="MODULE_NOT_FOUND",s}var u=t[a]={exports:{}};n[a][0].call(u.exports,function(e){var t=n[a][1][e];return o(t||e)},u,u.exports,e,n,t,r)}return t[a].exports}for(var i="function"==typeof require&&require,a=0;a<r.length;a++)o(r[a]);return o}({1:[function(e,n,t){self.window=self,importScripts("openpgp.min.js");var r=window.openpgp,o=[],i=6e4;function a(e){self.postMessage(e,r.util.getTransferables(e.data))}r.crypto.random.randomBuffer.init(i,function(){return o.length||self.postMessage({event:"request-seed",amount:i}),new Promise(function(e){o.push(e)})}),self.onmessage=function(e){var n,t=e.data||{};switch(t.event){case"configure":n=t.config,Object.keys(n).forEach(function(e){r.config[e]=n[e]});break;case"seed-random":!function(e){e instanceof Uint8Array||(e=new Uint8Array(e));r.crypto.random.randomBuffer.set(e)}(t.buf);var i=o;o=[];for(var f=0;f<i.length;f++)i[f]();break;default:!function(e,n,t){if("function"!=typeof r[n])return void a({id:e,event:"method-return",err:"Unknown Worker Event"});t=r.packet.clone.parseClonedPackets(t,n),r[n](t).then(function(n){a({id:e,event:"method-return",data:r.packet.clone.clonePackets(n)})}).catch(function(n){a({id:e,event:"method-return",err:n.message,stack:n.stack})})}(t.id,t.event,t.options||{})}}},{}]},{},[1]);

package.json

 {
   "name": "openpgp",
   "description": "OpenPGP.js is a Javascript implementation of the OpenPGP protocol. This is defined in RFC 4880.",
-  "version": "3.0.11",
+  "version": "3.0.12",
   "license": "LGPL-3.0+",
@@ -83,3 +83,3 @@ "homepage": "https://openpgpjs.org/",
     "hash.js": "^1.1.3",
-    "node-fetch": "^1.7.3",
+    "node-fetch": "^2.1.2",
     "node-localstorage": "~1.3.0",
@@ -86,0 +86,0 @@ "pako": "^1.0.6",

README.md

@@ -138,34 +138,47 @@ OpenPGP.js [![Build Status](https://travis-ci.org/openpgpjs/openpgpjs.svg?branch=master)](https://travis-ci.org/openpgpjs/openpgpjs)
 ```js
-var options, encrypted;
+const openpgp = require('openpgp') // use as CommonJS, AMD, ES6 module or via window.openpgp
+ 
+openpgp.initWorker({ path:'openpgp.worker.js' }) // set the relative web worker path
 
-var pubkey = '-----BEGIN PGP PUBLIC KEY BLOCK ... END PGP PUBLIC KEY BLOCK-----';
-var privkey = '-----BEGIN PGP PRIVATE KEY BLOCK ... END PGP PRIVATE KEY BLOCK-----'; //encrypted private key
-var passphrase = 'secret passphrase'; //what the privKey is encrypted with
+// put keys in backtick (``) to avoid errors caused by spaces or tabs
+const pubkey = `-----BEGIN PGP PUBLIC KEY BLOCK-----
+...
+-----END PGP PUBLIC KEY BLOCK-----`
+const privkey = `-----BEGIN PGP PRIVATE KEY BLOCK-----
+...
+-----END PGP PRIVATE KEY BLOCK-----` //encrypted private key
+const passphrase = `yourPassphrase` //what the privKey is encrypted with
 
-var privKeyObj = openpgp.key.readArmored(privkey).keys[0];
-await privKeyObj.decrypt(passphrase);
+const encryptDecryptFunction = async() => {
+    const privKeyObj = openpgp.key.readArmored(privkey).keys[0]
+    await privKeyObj.decrypt(passphrase)
+    
+    const options = {
+        data: 'Hello, World!',                             // input as String (or Uint8Array)
+        publicKeys: openpgp.key.readArmored(pubkey).keys,  // for encryption
+        privateKeys: [privKeyObj]                          // for signing (optional)
+    }
+    
+    openpgp.encrypt(options).then(ciphertext => {
+        encrypted = ciphertext.data // '-----BEGIN PGP MESSAGE ... END PGP MESSAGE-----'
+        return encrypted
+    })
+    .then(encrypted => {
+        const options = {
+            message: openpgp.message.readArmored(encrypted),     // parse armored message
+            publicKeys: openpgp.key.readArmored(pubkey).keys,    // for verification (optional)
+            privateKeys: [privKeyObj]                            // for decryption
+        }
+         
+        openpgp.decrypt(options).then(plaintext => {
+            console.log(plaintext.data)
+            return plaintext.data // 'Hello, World!'
+        })
+       
+    })
+}
 
-options = {
-    data: 'Hello, World!',                             // input as String (or Uint8Array)
-    publicKeys: openpgp.key.readArmored(pubkey).keys,  // for encryption
-    privateKeys: [privKeyObj]                          // for signing (optional)
-};
-
-openpgp.encrypt(options).then(function(ciphertext) {
-    encrypted = ciphertext.data; // '-----BEGIN PGP MESSAGE ... END PGP MESSAGE-----'
-});
+encryptDecryptFunction()
 ```
 
-```js
-options = {
-    message: openpgp.message.readArmored(encrypted),     // parse armored message
-    publicKeys: openpgp.key.readArmored(pubkey).keys,    // for verification (optional)
-    privateKeys: [privKeyObj]                            // for decryption
-};
-
-openpgp.decrypt(options).then(function(plaintext) {
-    return plaintext.data; // 'Hello, World!'
-});
-```
-
 #### Encrypt with compression
@@ -172,0 +185,0 @@

src/config/config.js

@@ -170,3 +170,9 @@ // GPG4Browsers - An OpenPGP implementation in javascript
    */
-  node_store:    "./openpgp.store"
+  node_store:    "./openpgp.store",
+  /**
+   * Max userid string length (used for parsing)
+   * @memberof module:config
+   * @property {Integer} max_userid_length
+   */
+  max_userid_length: 1024 * 5
 };

src/crypto/public_key/rsa.js

@@ -60,3 +60,3 @@ // GPG4Browsers - An OpenPGP implementation in javascript
     if (n.cmp(m) <= 0) {
-      throw new Error('Data too large.');
+      throw new Error('Message size cannot exceed modulus size');
     }
@@ -77,3 +77,3 @@ const nred = new BN.red(n);
     if (n.cmp(s) <= 0) {
-      throw new Error('Data too large.');
+      throw new Error('Signature size cannot exceed modulus size');
     }
@@ -94,3 +94,3 @@ const nred = new BN.red(n);
     if (n.cmp(m) <= 0) {
-      throw new Error('Data too large.');
+      throw new Error('Message size cannot exceed modulus size');
     }
@@ -97,0 +97,0 @@ const nred = new BN.red(n);

src/index.js

@@ -144,1 +144,7 @@ /* eslint-disable import/newline-after-import, import/first */
 export { default as HKP } from './hkp';
+
+/**
+ * @see module:wkd
+ * @name module:openpgp.WKD
+ */
+export { default as WKD } from './wkd';

src/packet/signature.js

@@ -525,3 +525,3 @@ // GPG4Browsers - An OpenPGP implementation in javascript
       // Signer's User ID
-      this.signersUserId += util.Uint8Array_to_str(bytes.subarray(mypos, bytes.length));
+      this.signersUserId = util.Uint8Array_to_str(bytes.subarray(mypos, bytes.length));
       break;
@@ -528,0 +528,0 @@ case 29:

src/util.js

@@ -172,3 +172,2 @@ // GPG4Browsers - An OpenPGP implementation in javascript
   b64_to_Uint8Array: function (base64) {
-//    atob(base64.replace(/-/g, '+').replace(/_/g, '/'));
     return b64.decode(base64.replace(/-/g, '+').replace(/_/g, '/'));
@@ -184,4 +183,3 @@ },
   Uint8Array_to_b64: function (bytes, url) {
-//    btoa(util.Uint8Array_to_str(bytes)).replace(/\+/g, '-').replace(/\//g, '_');
-    return b64.encode(bytes, url).replace('\n', '');
+    return b64.encode(bytes, url).replace(/(\n)/g, '');
   },
@@ -598,2 +596,5 @@
   parseUserId: function(userid) {
+    if (userid.length > config.max_userid_length) {
+      throw new Error('User id string is too long');
+    }
     try {
@@ -626,3 +627,39 @@ const [{ phrase: name, address: email, comment }] = rfc2822.parse(userid);
     return text.replace(/[ \t]+$/mg, "");
+  },
+
+  /**
+   * Encode input buffer using Z-Base32 encoding.
+   * See: https://tools.ietf.org/html/rfc6189#section-5.1.6
+   *
+   * @param {Uint8Array} data The binary data to encode
+   * @returns {String} Binary data encoded using Z-Base32
+   */
+  encodeZBase32: function(data) {
+    if (data.length === 0) {
+      return "";
+    }
+    const ALPHABET = "ybndrfg8ejkmcpqxot1uwisza345h769";
+    const SHIFT = 5;
+    const MASK = 31;
+    let buffer = data[0];
+    let index = 1;
+    let bitsLeft = 8;
+    let result = '';
+    while (bitsLeft > 0 || index < data.length) {
+      if (bitsLeft < SHIFT) {
+        if (index < data.length) {
+          buffer <<= 8;
+          buffer |= data[index++] & 0xff;
+          bitsLeft += 8;
+        } else {
+          const pad = SHIFT - bitsLeft;
+          buffer <<= pad;
+          bitsLeft += pad;
+        }
+      }
+      bitsLeft -= SHIFT;
+      result += ALPHABET[MASK & (buffer >> bitsLeft)];
+    }
+    return result;
   }
 };

test/general/brainpool.js

@@ -7,2 +7,3 @@ /* globals tryTests: true */
 chai.use(require('chai-as-promised'));
+const input = require('./testInputs.js');
 
@@ -226,6 +227,8 @@ const expect = chai.expect;
 
+          const testData = input.createSomeMessage();
+          const testData2 = input.createSomeMessage();
           return Promise.all([
             // Signing message
             openpgp.sign(
-              { data: 'Hi, this is me, Hi!', privateKeys: hi }
+              { data: testData, privateKeys: hi }
             ).then(signed => {
@@ -240,3 +243,3 @@ const msg = openpgp.cleartext.readArmored(signed.data);
                 openpgp.verify(
-                  { message: openpgp.message.fromText('Hi, this is me, Hi!'),
+                  { message: openpgp.message.fromText(testData),
                     publicKeys: pubHi,
@@ -249,3 +252,3 @@ signature: openpgp.signature.readArmored(signed.data) }
             openpgp.encrypt(
-              { data: 'Hi, Hi wrote this but only Bye can read it!',
+              { data: testData2,
                 publicKeys: [pubBye],
@@ -261,3 +264,3 @@ privateKeys: [hi] }
               ).then(output => {
-                expect(output.data).to.equal('Hi, Hi wrote this but only Bye can read it!');
+                expect(output.data).to.equal(testData2);
                 expect(output.signatures[0].valid).to.be.true;
@@ -264,0 +267,0 @@ });

test/general/ecc_nist.js

@@ -7,2 +7,3 @@ /* globals tryTests: true */
 chai.use(require('chai-as-promised'));
+const input = require('./testInputs.js');
 
@@ -242,2 +243,4 @@ const expect = chai.expect;
       const options = { userIds: {name: "Hi", email: "[e-mail]"}, curve: "p256" };
+      const testData = input.createSomeMessage();
+      const testData2 = input.createSomeMessage();
       return openpgp.generateKey(options).then(function (firstKey) {
@@ -254,4 +257,5 @@ const hi = firstKey.key;
             // Signing message
+
             openpgp.sign(
-              { data: 'Hi, this is me, Hi!', privateKeys: hi }
+              { data: testData, privateKeys: hi }
             ).then(signed => {
@@ -266,3 +270,3 @@ const msg = openpgp.cleartext.readArmored(signed.data);
                 openpgp.verify(
-                  { message: openpgp.message.fromText('Hi, this is me, Hi!'),
+                  { message: openpgp.message.fromText(testData),
                     publicKeys: pubHi,
@@ -275,3 +279,3 @@ signature: openpgp.signature.readArmored(signed.data) }
             openpgp.encrypt(
-              { data: 'Hi, Hi wrote this but only Bye can read it!',
+              { data: testData2,
                 publicKeys: [pubBye],
@@ -287,3 +291,3 @@ privateKeys: [hi] }
               ).then(output => {
-                expect(output.data).to.equal('Hi, Hi wrote this but only Bye can read it!');
+                expect(output.data).to.equal(testData2);
                 expect(output.signatures[0].valid).to.be.true;
@@ -290,0 +294,0 @@ });

test/general/index.js

@@ -10,2 +10,3 @@ describe('General', function () {
   require('./hkp.js');
+  require('./wkd.js');
   require('./oid.js');
@@ -12,0 +13,0 @@ require('./ecc_nist.js');

test/general/packet.js

@@ -8,2 +8,3 @@ const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : require('../../dist/openpgp');
 const { expect } = chai;
+const input = require('./testInputs.js');
 
@@ -62,5 +63,6 @@ function stringify(array) {
     const message = new openpgp.packet.List();
+    const testText = input.createSomeMessage();
 
     const literal = new openpgp.packet.Literal();
-    literal.setText('Hello world');
+    literal.setText(testText);
 
@@ -86,5 +88,6 @@ const enc = new openpgp.packet.SymmetricallyEncrypted();
     const message = new openpgp.packet.List();
+    const testText = input.createSomeMessage();
 
     const literal = new openpgp.packet.Literal();
-    literal.setText('Hello world');
+    literal.setText(testText);
 
@@ -108,2 +111,3 @@ const enc = new openpgp.packet.SymmetricallyEncrypted();
     const algo = 'aes256';
+    const testText = input.createSomeMessage();
 
@@ -115,3 +119,3 @@ const literal = new openpgp.packet.Literal();
     msg.push(enc);
-    literal.setText('Hello world!');
+    literal.setText(testText);
     enc.packets.push(literal);
@@ -131,3 +135,3 @@ await enc.encrypt(algo, key);
     const algo = 'aes256';
-
+    const testText = input.createSomeMessage();
     const literal = new openpgp.packet.Literal();
@@ -138,3 +142,3 @@ const enc = new openpgp.packet.SymEncryptedAEADProtected();
     msg.push(enc);
-    literal.setText('Hello world!');
+    literal.setText(testText);
     enc.packets.push(literal);
@@ -157,2 +161,3 @@
     openpgp.config.aead_protect_version = 4;
+    const testText = input.createSomeMessage();
 
@@ -167,3 +172,3 @@ const key = new Uint8Array([1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2]);
     msg.push(enc);
-    literal.setText('Hello world!');
+    literal.setText(testText);
     enc.packets.push(literal);
@@ -405,2 +410,3 @@
     const algo = 'aes256';
+    const testText = input.createSomeMessage();
 
@@ -420,3 +426,3 @@ const literal = new openpgp.packet.Literal();
 
-    literal.setText('Hello world!');
+    literal.setText(testText);
     enc.packets.push(literal);
@@ -444,2 +450,3 @@ await enc.encrypt(algo, key);
       const algo = 'aes256';
+      const testText = input.createSomeMessage();
 
@@ -459,3 +466,3 @@ const literal = new openpgp.packet.Literal();
 
-      literal.setText('Hello world!');
+      literal.setText(testText);
       enc.packets.push(literal);
@@ -717,2 +724,21 @@ await enc.encrypt(algo, key);
 
+  it('Reading signersUserId from armored signature', async function() {
+    const armored_sig =
+`-----BEGIN PGP SIGNATURE-----
+
+iQFKBAEBCgA0FiEEdOyNPagqedqiXfEMa6Ve2Dq64bsFAlszXwQWHHRlc3Qtd2tk
+QG1ldGFjb2RlLmJpegAKCRBrpV7YOrrhuw1PB/9KhFRR/M3OR6NmIent6ri1ekWn
+vlcnVqj6N4Xqi1ahRVw19/Jx36mGyijxNwqqGrziqRiPCdT0pKfCfv7nXQf2Up1Z
+LoR1StqpBMSDQfuF6JAJmJuB9T+mPQO8wYeUp+O63vQnm5CgqyoRlIoqX8MN6GTY
+xK5PdTRjw6IEIGr9uLgSoUwTd0ECY1F9ptyuLGD5ET5ZtyUenQSbX+cw5WCGLFzi
+7TwKTY+kGQpkwDJKZJSGpoP7ob6xdDfZx6dHV6IfIJg8/F9gtAXFp8uE51L90cV2
+kePFjAnu9cpynKXu3usf8+FuBw2zLsg1Id1n7ttxoAte416KjBN9lFBt8mcu
+=wEIR
+-----END PGP SIGNATURE-----`;
+
+    const signature = openpgp.signature.readArmored(armored_sig);
+
+    expect(signature.packets[0].signersUserId).to.equal('[e-mail]');
+  });
+
   it('Writing and encryption of a secret key packet.', function() {
@@ -791,2 +817,3 @@ const key = new openpgp.packet.List();
         });
+        const testText = input.createSomeMessage();
 
@@ -800,3 +827,3 @@ key.params = mpi;
 
-        literal.setText('Hello world');
+        literal.setText(testText);
 
@@ -803,0 +830,0 @@ signature.hashAlgorithm = 'sha256';

test/general/util.js

@@ -168,2 +168,9 @@ const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : require('../../dist/openpgp');
 
+  describe("Zbase32", function() {
+    it('util.encodeZBase32 encodes correctly', function() {
+      const encoded = openpgp.util.encodeZBase32(openpgp.util.str_to_Uint8Array('test-wkd'));
+      expect(encoded).to.equal('qt1zg7bpq7ise');
+    })
+  })
+
 });

test/general/x25519.js

@@ -9,2 +9,3 @@ const openpgp = typeof window !== 'undefined' && window.openpgp ? window.openpgp : require('../../dist/openpgp');
 const { expect } = chai;
+const input = require('./testInputs');
 
@@ -173,4 +174,5 @@ describe('X25519 Cryptography', function () {
     const name = 'light';
+    const randomData = input.createSomeMessage();
     const priv = await load_priv_key(name);
-    const signed = await openpgp.sign({ privateKeys: [priv], data: data[name].message + "\n" });
+    const signed = await openpgp.sign({ privateKeys: [priv], data: randomData});
     const pub = load_pub_key(name);
@@ -181,3 +183,3 @@ const msg = openpgp.cleartext.readArmored(signed.data);
     expect(result).to.exist;
-    expect(result.data.trim()).to.equal(data[name].message);
+    expect(result.data.trim()).to.equal(randomData);
     expect(result.signatures).to.have.length(1);
@@ -203,3 +205,4 @@ expect(result.signatures[0].valid).to.be.true;
     const lightPrivate = await load_priv_key('light');
-    const encrypted = await openpgp.encrypt({ publicKeys: [nightPublic], privateKeys: [lightPrivate], data: data.light.message + "\n" });
+    const randomData = input.createSomeMessage();
+    const encrypted = await openpgp.encrypt({ publicKeys: [nightPublic], privateKeys: [lightPrivate], data: randomData });
 
@@ -212,3 +215,3 @@ const message = openpgp.message.readArmored(encrypted.data);
     expect(result).to.exist;
-    expect(result.data.trim()).to.equal(data.light.message);
+    expect(result.data.trim()).to.equal(randomData);
     expect(result.signatures).to.have.length(1);
@@ -215,0 +218,0 @@ expect(result.signatures[0].valid).to.be.true;

No alert changes

Improved metrics

Total package byte prevSize

3608813

increased by0.4%

Number of package files

129

increased by2.38%

Lines of code

68546

increased by0.5%

Number of lines in readme file

393

increased by3.42%

Worsened metrics

Number of medium supply chain risk alerts

7

increased by16.67%

Dependency changes

• + Addednode-fetch@2.7.0(transitive)

• + Addedtr46@0.0.3(transitive)

• + Addedwebidl-conversions@3.0.1(transitive)

• + Addedwhatwg-url@5.0.0(transitive)

• - Removedencoding@0.1.13(transitive)

• - Removediconv-lite@0.6.3(transitive)

• - Removedis-stream@1.1.0(transitive)

• - Removednode-fetch@1.7.3(transitive)

• Updatednode-fetch@^2.1.2