rdf-canonize - npm Package Compare versions

Comparing version 3.0.0 to 3.1.0

lib/index.js

@@ -77,2 +77,8 @@ /**
  *          [useNative] use native implementation (default: false).
+ *          [maxDeepIterations=Infinity] the maximum number of times to run
+ *            deep comparison algorithms (such as the N-Degree Hash Quads
+ *            algorithm used in URDNA2015) before bailing out and throwing an
+ *            error; this is a useful setting for preventing wasted CPU cycles
+ *            or DoS when canonizing meaningless or potentially malicious
+ *            datasets, a recommended value is `1`.
  *
@@ -120,2 +126,8 @@ * @return a Promise that resolves to the canonicalized RDF Dataset.
  *          [useNative] use native implementation (default: false).
+ *          [maxDeepIterations=Infinity] the maximum number of times to run
+ *            deep comparison algorithms (such as the N-Degree Hash Quads
+ *            algorithm used in URDNA2015) before bailing out and throwing an
+ *            error; this is a useful setting for preventing wasted CPU cycles
+ *            or DoS when canonizing meaningless or potentially malicious
+ *            datasets, a recommended value is `1`.
  *
@@ -122,0 +134,0 @@ * @return the RDF dataset in canonical form.

lib/URDNA2015.js

 /*
- * Copyright (c) 2016-2021 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2016-2022 Digital Bazaar, Inc. All rights reserved.
  */
@@ -12,3 +12,3 @@ 'use strict';
 module.exports = class URDNA2015 {
-  constructor() {
+  constructor({maxDeepIterations = Infinity} = {}) {
     this.name = 'URDNA2015';
@@ -18,3 +18,5 @@ this.blankNodeInfo = new Map();
     this.hashAlgorithm = 'sha256';
+    this.maxDeepIterations = maxDeepIterations;
     this.quads = null;
+    this.deepIterations = null;
   }
@@ -24,2 +26,3 @@
   async main(dataset) {
+    this.deepIterations = new Map();
     this.quads = dataset;
@@ -249,2 +252,9 @@
   async hashNDegreeQuads(id, issuer) {
+    const deepIterations = this.deepIterations.get(id) || 0;
+    if(deepIterations > this.maxDeepIterations) {
+      throw new Error(
+        `Maximum deep iterations (${this.maxDeepIterations}) exceeded.`);
+    }
+    this.deepIterations.set(id, deepIterations + 1);
+
     // 1) Create a hash to related blank nodes map for storing hashes that
@@ -251,0 +261,0 @@ // identify related blank nodes.

lib/URDNA2015Sync.js

 /*
- * Copyright (c) 2016-2021 Digital Bazaar, Inc. All rights reserved.
+ * Copyright (c) 2016-2022 Digital Bazaar, Inc. All rights reserved.
  */
@@ -12,3 +12,3 @@ 'use strict';
 module.exports = class URDNA2015Sync {
-  constructor() {
+  constructor({maxDeepIterations = Infinity} = {}) {
     this.name = 'URDNA2015';
@@ -18,3 +18,5 @@ this.blankNodeInfo = new Map();
     this.hashAlgorithm = 'sha256';
+    this.maxDeepIterations = maxDeepIterations;
     this.quads = null;
+    this.deepIterations = null;
   }
@@ -24,2 +26,3 @@
   main(dataset) {
+    this.deepIterations = new Map();
     this.quads = dataset;
@@ -244,2 +247,9 @@
   hashNDegreeQuads(id, issuer) {
+    const deepIterations = this.deepIterations.get(id) || 0;
+    if(deepIterations > this.maxDeepIterations) {
+      throw new Error(
+        `Maximum deep iterations (${this.maxDeepIterations}) exceeded.`);
+    }
+    this.deepIterations.set(id, deepIterations + 1);
+
     // 1) Create a hash to related blank nodes map for storing hashes that
@@ -246,0 +256,0 @@ // identify related blank nodes.

package.json

 {
   "name": "rdf-canonize",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "An implementation of the RDF Dataset Normalization Algorithm in JavaScript",
@@ -5,0 +5,0 @@ "homepage": "https://github.com/digitalbazaar/rdf-canonize",

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Improved metrics

Lines of code

1768

increased by1.73%

Worsened metrics

Total package byte prevSize

72955

decreased by-5%

Number of package files

14

decreased by-6.67%

No dependency changes