@smartledger/bsv 9.16.0 → 9.18.0

package/lib/script/script.js

@@ -12,6 +12,7 @@ var Networks = require('../networks')
 var $ = require('../util/preconditions')
 var _ = require('../util/_')
 var errors = require('../errors')
+var deprecate = require('../util/deprecate')
 var buffer = require('buffer')
 var JSUtil = require('../util/js')
 
@@ -244,7 +245,38 @@ Script.fromASM = function (str) {
   return script
 }
 
+// A pair of hex digits per byte, or nothing. One test covers both ways a string can
+// fail to decode whole: a character that is not hex, and an odd number of digits.
+// `JSUtil.isHexa` is not enough on its own — it accepts '76a91', which drops its last
+// nibble.
+var FULL_HEX = /^(?:[0-9a-fA-F]{2})*$/
+
 Script.fromHex = function (str) {
+  // `Buffer.from(str, 'hex')` stops at the first character it cannot decode and returns
+  // what it had, so a malformed string yields a SHORTER script, or none, instead of an
+  // error. `Script.fromString` just below has always refused that with `JSUtil.isHexa`;
+  // this function never did. A caller that builds an output from the result pays to a
+  // truncated script and nothing tells it:
+  //
+  //   Script.fromHex('<p2pkh hex>' + '\n...')  -> the 25-byte prefix, still a valid P2PKH
+  //   Script.fromHex('<html>503</html>')       -> 0 bytes, and addOutput accepts it
+  //
+  // Truncation can only ever drop a suffix — it cannot change the bytes it did decode —
+  // so an address derived from the result is always the one the input's leading bytes
+  // named, never a third party's. That bounds the damage but does not make it correct.
+  //
+  // Refusing it outright is a breaking change, so this marks it and 10.0.0 throws
+  // (STABILITY.md: no major before 2027-09-01). Callers who want the strict behaviour
+  // now should test the round trip: `Script.fromHex(h).toHex() === h.toLowerCase()`.
+  if (typeof str === 'string' && !FULL_HEX.test(str)) {
+    deprecate({
+      what: 'Script.fromHex() with a string that is not whole hex',
+      since: '9.17.0',
+      removeIn: '10.0.0',
+      why: 'Buffer.from() stops at the first character it cannot decode, so the script is silently truncated',
+      use: 'a round-trip check, Script.fromHex(h).toHex() === h.toLowerCase()'
+    })
+  }
   return new Script(buffer.Buffer.from(str, 'hex'))
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "9.16.0",
+  "version": "9.18.0",
   "description": "Bitcoin SV library with an interpreter-verified script engine: OP_PUSH_TX covenants, BIP-143 preimage tooling, and consensus flags that match what miners actually enforce. Also ships DID:web / W3C VC-JWT credentials and the Legal Token Protocol.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -214,9 +214,9 @@
     "request": "browser-request"
   },
   "dependencies": {
-    "@noble/ciphers": "^2.3.0",
-    "@noble/curves": "^2.3.0",
-    "@noble/hashes": "^2.3.0",
+    "@noble/ciphers": "^2.4.0",
+    "@noble/curves": "^2.4.0",
+    "@noble/hashes": "^2.4.0",
     "@types/node": "^20.19.0",
     "bn.js": "=4.12.5",
     "secrets.js-grempe": "^2.0.0"

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '9.16.0'
+module.exports = '9.18.0'