sshpk - npm Package Compare versions

Comparing version 1.0.3 to 1.0.4

lib/fingerprint.js

@@ -71,3 +71,9 @@ // Copyright 2015 Joyent, Inc.
 		alg = parts[0].toLowerCase();
-		hash = new Buffer(parts[1], 'base64');
+		if (!/^[A-Za-z0-9+\/=]+$/.test(parts[1]))
+			throw (new FingerprintFormatError(fp));
+		try {
+			hash = new Buffer(parts[1], 'base64');
+		} catch (e) {
+			throw (new FingerprintFormatError(fp));
+		}
 	} else if (parts.length > 2) {
@@ -80,3 +86,7 @@ alg = 'md5';
 			throw (new FingerprintFormatError(fp));
-		hash = new Buffer(parts, 'hex');
+		try {
+			hash = new Buffer(parts, 'hex');
+		} catch (e) {
+			throw (new FingerprintFormatError(fp));
+		}
 	}
@@ -83,0 +93,0 @@

package.json

 {
   "name": "sshpk",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "A library for finding and using SSH public keys",
@@ -5,0 +5,0 @@ "main": "lib/index.js",

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

40597

0.57%

Lines of code

1017

0.99%

No dependency changes