@zerodev/wallet-core 0.0.3 → 0.0.4

package/src/utils/derToRawSignature.ts

@@ -23,9 +23,16 @@ export function derToRawSignature(derHex: string): string {
   }
   offset++ // Skip INTEGER tag
 
-  const rLength = der[offset]!
+  const rLength = der[offset]
+  if (rLength === undefined) {
+    throw new Error('Invalid DER signature: missing r length')
+  }
   offset++ // Skip length byte
 
+  if (offset + rLength > der.length) {
+    throw new Error('Invalid DER signature: truncated r value')
+  }
+
   const rBytes = der.slice(offset, offset + rLength)
   offset += rLength
 
@@ -35,9 +42,16 @@ export function derToRawSignature(derHex: string): string {
   }
   offset++ // Skip INTEGER tag
 
-  const sLength = der[offset]!
+  const sLength = der[offset]
+  if (sLength === undefined) {
+    throw new Error('Invalid DER signature: missing s length')
+  }
   offset++ // Skip length byte
 
+  if (offset + sLength > der.length) {
+    throw new Error('Invalid DER signature: truncated s value')
+  }
+
   const sBytes = der.slice(offset, offset + sLength)
 
   // Remove leading zero bytes if present (DER uses signed integers)

package/src/utils/exportPrivateKey.ts

@@ -110,7 +110,7 @@ export async function exportPrivateKey(
     )
   }
 
-  return { exportBundle, address: address!, organizationId }
+  return { exportBundle, address, organizationId }
 }
 
 export type { KeyFormat }

package/src/utils/utils.ts

@@ -1,5 +1,5 @@
 import type { PartialBy } from 'viem'
-import type { ZeroDevWalletSession } from '../types/session.js'
+import { SessionType, type ZeroDevWalletSession } from '../types/session.js'
 
 /**
  * Parses a session from a JWT.
@@ -13,31 +13,50 @@ export function parseSession(
   if (typeof token !== 'string') {
     return token
   }
-  const [, payload] = token.split('.')
-  if (!payload) {
+  const parts = token.split('.')
+  if (parts.length !== 3 || !parts[1]) {
     throw new Error('Invalid JWT: Missing payload')
   }
 
-  const base64 = payload.replace(/-/g, '+').replace(/_/g, '/')
-  const decoded = JSON.parse(atob(base64))
+  const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/')
+  const decoded: unknown = JSON.parse(atob(base64))
+  if (!decoded || typeof decoded !== 'object') {
+    throw new Error('JWT payload missing required fields')
+  }
   const {
     exp,
     public_key: publicKey,
     session_type: sessionType,
     user_id: userId,
     organization_id: organizationId,
-  } = decoded
+  } = decoded as Record<string, unknown>
 
-  if (!exp || !publicKey || !sessionType || !userId || !organizationId) {
+  if (
+    typeof exp !== 'number' ||
+    !Number.isFinite(exp) ||
+    exp <= 0 ||
+    typeof publicKey !== 'string' ||
+    !publicKey ||
+    (sessionType !== SessionType.READ_ONLY &&
+      sessionType !== SessionType.READ_WRITE) ||
+    typeof userId !== 'string' ||
+    !userId ||
+    typeof organizationId !== 'string' ||
+    !organizationId
+  ) {
     throw new Error('JWT payload missing required fields')
   }
+  if (normalizeTimestamp(exp) <= Date.now()) {
+    throw new Error('JWT session is already expired')
+  }
 
   return {
     sessionType,
     userId,
     organizationId,
     expiry: exp,
-    token: publicKey,
+    token,
+    publicKey,
   }
 }
 
@@ -93,7 +112,9 @@ export function pointEncode(raw: Uint8Array): Uint8Array {
     throw new Error('Invalid x or y length')
   }
 
-  const prefix = (y[31]! & 1) === 0 ? 0x02 : 0x03
+  const lastY = y.at(-1)
+  if (lastY === undefined) throw new Error('Invalid y coordinate')
+  const prefix = (lastY & 1) === 0 ? 0x02 : 0x03
 
   const compressed = new Uint8Array(33)
   compressed[0] = prefix