@hardlydifficult/worker-server 1.0.16 → 1.0.18

package/dist/safeCompare.d.ts

@@ -1,6 +1,8 @@
 /**
- * Timing-safe string comparison to prevent brute-force attacks.
- * Always takes constant time regardless of where strings differ.
+ * Constant-time string comparison to prevent timing attacks.
+ *
+ * Pads both values to the same length before comparing so the timing-safe
+ * compare path is always executed, even for different-length inputs.
  */
 export declare function safeCompare(a: string, b: string): boolean;
 //# sourceMappingURL=safeCompare.d.ts.map

package/dist/safeCompare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safeCompare.d.ts","sourceRoot":"","sources":["../src/safeCompare.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAWzD"}
+{"version":3,"file":"safeCompare.d.ts","sourceRoot":"","sources":["../src/safeCompare.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAczD"}

package/dist/safeCompare.js

@@ -3,17 +3,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.safeCompare = safeCompare;
 const crypto_1 = require("crypto");
 /**
- * Timing-safe string comparison to prevent brute-force attacks.
- * Always takes constant time regardless of where strings differ.
+ * Constant-time string comparison to prevent timing attacks.
+ *
+ * Pads both values to the same length before comparing so the timing-safe
+ * compare path is always executed, even for different-length inputs.
  */
 function safeCompare(a, b) {
     const bufA = Buffer.from(a);
     const bufB = Buffer.from(b);
-    if (bufA.length !== bufB.length) {
-        // Compare bufA against itself so the timing is consistent
-        (0, crypto_1.timingSafeEqual)(bufA, bufA);
-        return false;
-    }
-    return (0, crypto_1.timingSafeEqual)(bufA, bufB);
+    const maxLength = Math.max(bufA.length, bufB.length);
+    const paddedA = Buffer.alloc(maxLength);
+    const paddedB = Buffer.alloc(maxLength);
+    bufA.copy(paddedA);
+    bufB.copy(paddedB);
+    const valuesMatch = (0, crypto_1.timingSafeEqual)(paddedA, paddedB);
+    return bufA.length === bufB.length && valuesMatch;
 }
 //# sourceMappingURL=safeCompare.js.map

package/dist/safeCompare.js.map

@@ -1 +1 @@
-{"version":3,"file":"safeCompare.js","sourceRoot":"","sources":["../src/safeCompare.ts"],"names":[],"mappings":";;AAMA,kCAWC;AAjBD,mCAAyC;AAEzC;;;GAGG;AACH,SAAgB,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE5B,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QAChC,0DAA0D;QAC1D,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"safeCompare.js","sourceRoot":"","sources":["../src/safeCompare.ts"],"names":[],"mappings":";;AAQA,kCAcC;AAtBD,mCAAyC;AAEzC;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAExC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAEnB,MAAM,WAAW,GAAG,IAAA,wBAAe,EAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEtD,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;AACpD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hardlydifficult/worker-server",
-  "version": "1.0.16",
+  "version": "1.0.18",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
@@ -31,7 +31,8 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
-      "require": "./dist/index.js"
+      "require": "./dist/index.js",
+      "default": "./dist/index.js"
     }
   }
 }