tendermint - npm Package Compare versions

Comparing version 4.0.3 to 4.0.4

lib/verify.js

@@ -72,8 +72,18 @@ 'use strict';
       if (precommit == null) continue;
+      if (!precommit.block_id.hash) continue;
 
       precommit.height = safeParseInt(precommit.height);
       precommit.round = safeParseInt(precommit.round);
-      // ensure precommit uses correct block_id (ignore the one it had)
-      precommit.block_id = commit.block_id;
 
+      // all fields of block ID must match commit
+      if (precommit.block_id.hash !== commit.block_id.hash) {
+        throw Error('Precommit block hash does not match commit');
+      }
+      if (safeParseInt(precommit.block_id.parts.total) !== safeParseInt(commit.block_id.parts.total)) {
+        throw Error('Precommit parts count does not match commit');
+      }
+      if (precommit.block_id.parts.hash !== commit.block_id.parts.hash) {
+        throw Error('Precommit parts hash does not match commit');
+      }
+
       // height must match header
@@ -169,2 +179,3 @@ if (precommit.height !== header.height) {
       if (precommit == null) continue;
+      if (!precommit.block_id.hash) continue;
 
@@ -171,0 +182,0 @@ var _validator = validatorsByAddress[precommit.validator_address];

package.json

 {
   "name": "tendermint",
-  "version": "4.0.3",
+  "version": "4.0.4",
   "description": "A light client which talks to your Tendermint node over RPC",
@@ -5,0 +5,0 @@ "main": "index.js",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

48457

increased by1.03%

Lines of code

1143

increased by0.88%

No dependency changes