meteor-node-stubs 1.2.10 → 1.2.12

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+v1.2.12 - 2024-10-31
+
+* Update `elliptic` to v6.6.0 to address a security vulnerability.
+
+v1.2.11 - 2024-10-25
+
+* Update `rimraf` to v5 to remove vulnerable `inflight` dependency.
+
 v1.2.8 - 2024-04-01
 * Add new dependency `@meteorjs/crypto-browserify` to replace `crypto-browserify` as it had unsafe dependencies.
 

package/node_modules/elliptic/lib/elliptic/ec/index.js

@@ -78,8 +78,27 @@ EC.prototype.genKeyPair = function genKeyPair(options) {
   }
 };
 
-EC.prototype._truncateToN = function _truncateToN(msg, truncOnly) {
-  var delta = msg.byteLength() * 8 - this.n.bitLength();
+EC.prototype._truncateToN = function _truncateToN(msg, truncOnly, bitLength) {
+  var byteLength;
+  if (BN.isBN(msg) || typeof msg === 'number') {
+    msg = new BN(msg, 16);
+    byteLength = msg.byteLength();
+  } else if (typeof msg === 'object') {
+    // BN assumes an array-like input and asserts length
+    byteLength = msg.length;
+    msg = new BN(msg, 16);
+  } else {
+    // BN converts the value to string
+    var str = msg.toString();
+    // HEX encoding
+    byteLength = (str.length + 1) >>> 1;
+    msg = new BN(str, 16);
+  }
+  // Allow overriding
+  if (typeof bitLength !== 'number') {
+    bitLength = byteLength * 8;
+  }
+  var delta = bitLength - this.n.bitLength();
   if (delta > 0)
     msg = msg.ushrn(delta);
   if (!truncOnly && msg.cmp(this.n) >= 0)
@@ -97,7 +116,7 @@ EC.prototype.sign = function sign(msg, key, enc, options) {
     options = {};
 
   key = this.keyFromPrivate(key, enc);
-  msg = this._truncateToN(new BN(msg, 16));
+  msg = this._truncateToN(msg, false, options.msgBitLength);
 
   // Zero-extend key to provide enough entropy
   var bytes = this.n.byteLength();
@@ -153,8 +172,11 @@ EC.prototype.sign = function sign(msg, key, enc, options) {
   }
 };
 
-EC.prototype.verify = function verify(msg, signature, key, enc) {
-  msg = this._truncateToN(new BN(msg, 16));
+EC.prototype.verify = function verify(msg, signature, key, enc, options) {
+  if (!options)
+    options = {};
+
+  msg = this._truncateToN(msg, false, options.msgBitLength);
   key = this.keyFromPublic(key, enc);
   signature = new Signature(signature, 'hex');
 

package/node_modules/elliptic/lib/elliptic/ec/key.js

@@ -111,8 +111,8 @@ KeyPair.prototype.sign = function sign(msg, enc, options) {
   return this.ec.sign(msg, this, enc, options);
 };
 
-KeyPair.prototype.verify = function verify(msg, signature) {
-  return this.ec.verify(msg, signature, this);
+KeyPair.prototype.verify = function verify(msg, signature, options) {
+  return this.ec.verify(msg, signature, this, undefined, options);
 };
 
 KeyPair.prototype.inspect = function inspect() {

package/node_modules/elliptic/package.json

@@ -1,6 +1,6 @@
 {
   "name": "elliptic",
-  "version": "6.5.7",
+  "version": "6.6.0",
   "description": "EC cryptography",
   "main": "lib/elliptic.js",
   "files": [

package/package.json

@@ -2,7 +2,7 @@
   "name": "meteor-node-stubs",
   "author": "Ben Newman <ben@meteor.com>",
   "description": "Stub implementations of Node built-in modules, a la Browserify",
-  "version": "1.2.10",
+  "version": "1.2.12",
   "main": "index.js",
   "license": "MIT",
   "homepage": "https://github.com/meteor/meteor/blob/devel/npm-packages/meteor-node-stubs/README.md",
@@ -18,7 +18,7 @@
     "console-browserify": "^1.2.0",
     "constants-browserify": "^1.0.0",
     "domain-browser": "^4.23.0",
-    "elliptic": "^6.5.7",
+    "elliptic": "^6.6.0",
     "events": "^3.3.0",
     "https-browserify": "^1.0.0",
     "os-browserify": "^0.3.0",
@@ -62,7 +62,7 @@
     "vm-browserify"
   ],
   "devDependencies": {
-    "rimraf": "^2.7.1"
+    "rimraf": "^5.0.10"
   },
   "repository": {
     "type": "git",

package/scripts/build-deps.js

@@ -2,6 +2,7 @@ var fs = require("fs");
 var path = require("path");
 var depsDir = path.join(__dirname, "..", "deps");
 var map = require("../map.json");
+var rr = require("rimraf");
 
 // Each file in the `deps` directory expresses the dependencies of a stub.
 // For example, `deps/http.js` calls `require("http-browserify")` to
@@ -14,16 +15,15 @@ var map = require("../map.json");
 // bundled. Note that these modules should not be `require`d at runtime,
 // but merely scanned at bundling time.
 
-fs.mkdir(depsDir, function () {
-  require("rimraf")("deps/*.js", function (error) {
-    if (error) throw error;
-    Object.keys(map).forEach(function (id) {
-      fs.writeFileSync(
-        path.join(depsDir, id + ".js"),
-        typeof map[id] === "string"
-          ? "require(" + JSON.stringify(map[id]) + ");\n"
-          : ""
-      );
-    });
-  });
+rr.rimrafSync(depsDir);
+
+fs.mkdirSync(depsDir);
+
+Object.keys(map).forEach(function (id) {
+  fs.writeFileSync(
+    path.join(depsDir, id + ".js"),
+    typeof map[id] === "string"
+      ? "require(" + JSON.stringify(map[id]) + ");\n"
+      : ""
+  );
 });