meteor-node-stubs 1.2.13 → 1.2.14

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+v1.2.13 - 2025-02-27
+
+* Update `elliptic` to v6.6.1 to address a security vulnerability.
+
 v1.2.12 - 2024-10-31
 
 * Update `elliptic` to v6.6.0 to address a security vulnerability.

package/node_modules/@meteorjs/crypto-browserify/package.json

@@ -2,7 +2,7 @@
   "author": "Dominic Tarr <dominic.tarr@gmail.com> (dominictarr.com)",
   "name": "@meteorjs/crypto-browserify",
   "description": "implementation of crypto for the browser",
-  "version": "3.12.1",
+  "version": "3.12.2",
   "homepage": "https://github.com/meteor-compat/crypto-browserify",
   "sideEffects": false,
   "repository": {
@@ -24,8 +24,8 @@
   },
   "dependencies": {
     "browserify-cipher": "^1.0.1",
-    "browserify-sign": "^4.2.3",
-    "create-ecdh": "^4.0.4",
+    "browserify-sign": "github:meteor-compat/browserify-sign",
+    "create-ecdh": "github:meteor-compat/createECDH",
     "create-hash": "^1.2.0",
     "create-hmac": "^1.1.7",
     "diffie-hellman": "^5.0.3",

package/node_modules/@meteorjs/crypto-browserify/test/aes.js

@@ -7,7 +7,7 @@ var randomBytes = require('pseudorandombytes');
 
 for (var i = 0; i < 4; i += 1) {
 	bcCrypto.listCiphers().forEach(function (cipher) {
-		test('run: ' + i, function (t) {
+		test.skip('run: ' + i, function (t) {
 			/* eslint no-loop-func: 0 */
 			t.test('ciphers: ' + cipher, function (st) {
 				st.plan(1);
@@ -34,7 +34,7 @@ test('getCiphers', function (t) {
 	t.ok(bcCyphers.length, 'get ciphers returns an array');
 });
 
-test('through crypto browserify works', function (t) {
+test.skip('through crypto browserify works', function (t) {
 	t.plan(2);
 	var crypto = require('../'); // eslint-disable-line global-require
 	var cipher = 'aes-128-ctr';

package/node_modules/browserify-sign/node_modules/hash-base/README.md

@@ -1,39 +1,39 @@
 # hash-base
 
-[![NPM Package](https://img.shields.io/npm/v/hash-base.svg?style=flat-square)](https://www.npmjs.org/package/hash-base)
+[![npm Package](https://img.shields.io/npm/v/hash-base.svg?style=flat-square)](https://www.npmjs.org/package/hash-base)
 [![Build Status](https://img.shields.io/travis/crypto-browserify/hash-base.svg?branch=master&style=flat-square)](https://travis-ci.org/crypto-browserify/hash-base)
 [![Dependency status](https://img.shields.io/david/crypto-browserify/hash-base.svg?style=flat-square)](https://david-dm.org/crypto-browserify/hash-base#info=dependencies)
 
-[![js-standard-style](https://cdn.rawgit.com/feross/standard/master/badge.svg)](https://github.com/feross/standard)
-
 Abstract base class to inherit from if you want to create streams implementing the same API as node crypto [Hash][1] (for [Cipher][2] / [Decipher][3] check [crypto-browserify/cipher-base][4]).
 
 ## Example
 
 ```js
-const HashBase = require('hash-base')
-const inherits = require('inherits')
+const HashBase = require('hash-base');
+const inherits = require('inherits');
 
 // our hash function is XOR sum of all bytes
 function MyHash () {
-  HashBase.call(this, 1) // in bytes
+	HashBase.call(this, 1); // in bytes
 
-  this._sum = 0x00
-}
+	this._sum = 0x00;
+};
 
 inherits(MyHash, HashBase)
 
 MyHash.prototype._update = function () {
-  for (let i = 0; i < this._block.length; ++i) this._sum ^= this._block[i]
-}
+	for (let i = 0; i < this._block.length; ++i) {
+		this._sum ^= this._block[i];
+	}
+};
 
 MyHash.prototype._digest = function () {
-  return this._sum
-}
+	return this._sum;
+};
 
-const data = Buffer.from([ 0x00, 0x42, 0x01 ])
-const hash = new MyHash().update(data).digest()
-console.log(hash) // => 67
+const data = Buffer.from([0x00, 0x42, 0x01]);
+const hash = new MyHash().update(data).digest();
+console.log(hash); // => 67
 ```
 You also can check [source code](index.js) or [crypto-browserify/md5.js][5]
 

package/node_modules/browserify-sign/node_modules/hash-base/index.js

@@ -3,12 +3,6 @@ var Buffer = require('safe-buffer').Buffer
 var Transform = require('stream').Transform
 var inherits = require('inherits')
 
-function throwIfNotStringOrBuffer (val, prefix) {
-  if (!Buffer.isBuffer(val) && typeof val !== 'string') {
-    throw new TypeError(prefix + ' must be a string or a buffer')
-  }
-}
-
 function HashBase (blockSize) {
   Transform.call(this)
 
@@ -44,10 +38,59 @@ HashBase.prototype._flush = function (callback) {
   callback(error)
 }
 
+var useUint8Array = typeof Uint8Array !== 'undefined'
+var useArrayBuffer = typeof ArrayBuffer !== 'undefined' &&
+  typeof Uint8Array !== 'undefined' &&
+  ArrayBuffer.isView &&
+  (Buffer.prototype instanceof Uint8Array || Buffer.TYPED_ARRAY_SUPPORT)
+
+function toBuffer (data, encoding) {
+  // No need to do anything for exact instance
+  // This is only valid when safe-buffer.Buffer === buffer.Buffer, i.e. when Buffer.from/Buffer.alloc existed
+  if (data instanceof Buffer) return data
+
+  // Convert strings to Buffer
+  if (typeof data === 'string') return Buffer.from(data, encoding)
+
+  /*
+   * Wrap any TypedArray instances and DataViews
+   * Makes sense only on engines with full TypedArray support -- let Buffer detect that
+   */
+  if (useArrayBuffer && ArrayBuffer.isView(data)) {
+    if (data.byteLength === 0) return Buffer.alloc(0) // Bug in Node.js <6.3.1, which treats this as out-of-bounds
+    var res = Buffer.from(data.buffer, data.byteOffset, data.byteLength)
+    // Recheck result size, as offset/length doesn't work on Node.js <5.10
+    // We just go to Uint8Array case if this fails
+    if (res.byteLength === data.byteLength) return res
+  }
+
+  /*
+   * Uint8Array in engines where Buffer.from might not work with ArrayBuffer, just copy over
+   * Doesn't make sense with other TypedArray instances
+   */
+  if (useUint8Array && data instanceof Uint8Array) return Buffer.from(data)
+
+  /*
+   * Old Buffer polyfill on an engine that doesn't have TypedArray support
+   * Also, this is from a different Buffer polyfill implementation then we have, as instanceof check failed
+   * Convert to our current Buffer implementation
+   */
+  if (
+    Buffer.isBuffer(data) &&
+    data.constructor &&
+    typeof data.constructor.isBuffer === 'function' &&
+    data.constructor.isBuffer(data)
+  ) {
+    return Buffer.from(data)
+  }
+
+  throw new TypeError('The "data" argument must be of type string or an instance of Buffer, TypedArray, or DataView.')
+}
+
 HashBase.prototype.update = function (data, encoding) {
-  throwIfNotStringOrBuffer(data, 'Data')
   if (this._finalized) throw new Error('Digest already called')
-  if (!Buffer.isBuffer(data)) data = Buffer.from(data, encoding)
+
+  data = toBuffer(data, encoding) // asserts correct input type
 
   // consume data
   var block = this._block

package/node_modules/browserify-sign/node_modules/hash-base/package.json

@@ -1,41 +1,42 @@
 {
-  "name": "hash-base",
-  "version": "3.0.4",
-  "description": "abstract base class for hash-streams",
-  "keywords": [
-    "hash",
-    "stream"
-  ],
-  "homepage": "https://github.com/crypto-browserify/hash-base",
-  "bugs": {
-    "url": "https://github.com/crypto-browserify/hash-base/issues"
-  },
-  "license": "MIT",
-  "author": "Kirill Fomichev <fanatid@ya.ru> (https://github.com/fanatid)",
-  "files": [
-    "index.js"
-  ],
-  "main": "index.js",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/crypto-browserify/hash-base.git"
-  },
-  "scripts": {
-    "coverage": "nyc node test/*.js",
-    "lint": "standard",
-    "test": "npm run lint && npm run unit",
-    "unit": "node test/*.js"
-  },
-  "dependencies": {
-    "inherits": "^2.0.1",
-    "safe-buffer": "^5.0.1"
-  },
-  "devDependencies": {
-    "nyc": "^8.3.2",
-    "standard": "*",
-    "tape": "^4.2.0"
-  },
-  "engines": {
-    "node": ">=4"
-  }
+	"name": "hash-base",
+	"version": "3.0.5",
+	"description": "abstract base class for hash-streams",
+	"keywords": [
+		"hash",
+		"stream"
+	],
+	"homepage": "https://github.com/crypto-browserify/hash-base",
+	"bugs": {
+		"url": "https://github.com/crypto-browserify/hash-base/issues"
+	},
+	"license": "MIT",
+	"author": "Kirill Fomichev <fanatid@ya.ru> (https://github.com/fanatid)",
+	"files": [
+		"index.js"
+	],
+	"main": "index.js",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/crypto-browserify/hash-base.git"
+	},
+	"scripts": {
+		"lint": "standard",
+		"pretest": "npm run lint",
+		"test": "npm run tests-only",
+		"tests-only": "nyc tape 'test/**/*.js'",
+		"posttest": "npx npm@'>=10.2' audit --production"
+	},
+	"dependencies": {
+		"inherits": "^2.0.4",
+		"safe-buffer": "^5.2.1"
+	},
+	"devDependencies": {
+		"nyc": "^10.3.2",
+		"standard": "^14.3.3",
+		"tape": "^5.9.0"
+	},
+	"engines": {
+		"node": ">= 0.10"
+	}
 }

package/node_modules/browserify-sign/package.json

@@ -33,7 +33,7 @@
 		"browserify-rsa": "^4.1.0",
 		"create-hash": "^1.2.0",
 		"create-hmac": "^1.1.7",
-		"elliptic": "^6.5.5",
+		"elliptic": "^6.6.1",
 		"hash-base": "~3.0",
 		"inherits": "^2.0.4",
 		"parse-asn1": "^5.1.7",

package/node_modules/create-ecdh/node_modules/bn.js/lib/bn.js

@@ -452,16 +452,16 @@
         var w = this.words[i];
         var word = (((w << off) | carry) & 0xffffff).toString(16);
         carry = (w >>> (24 - off)) & 0xffffff;
-        if (carry !== 0 || i !== this.length - 1) {
-          out = zeros[6 - word.length] + word + out;
-        } else {
-          out = word + out;
-        }
         off += 2;
         if (off >= 26) {
           off -= 26;
           i--;
         }
+        if (carry !== 0 || i !== this.length - 1) {
+          out = zeros[6 - word.length] + word + out;
+        } else {
+          out = word + out;
+        }
       }
       if (carry !== 0) {
         out = carry.toString(16) + out;

package/node_modules/create-ecdh/node_modules/bn.js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bn.js",
-  "version": "4.12.0",
+  "version": "4.12.1",
   "description": "Big number implementation in pure javascript",
   "main": "lib/bn.js",
   "scripts": {

package/node_modules/create-ecdh/node_modules/bn.js/util/genCombMulTo.js

@@ -0,0 +1,65 @@
+'use strict';
+
+// NOTE: This could be potentionally used to generate loop-less multiplications
+function genCombMulTo (alen, blen) {
+  var len = alen + blen - 1;
+  var src = [
+    'var a = self.words;',
+    'var b = num.words;',
+    'var o = out.words;',
+    'var c = 0;',
+    'var lo;',
+    'var mid;',
+    'var hi;'
+  ];
+  for (var i = 0; i < alen; i++) {
+    src.push('var a' + i + ' = a[' + i + '] | 0;');
+    src.push('var al' + i + ' = a' + i + ' & 0x1fff;');
+    src.push('var ah' + i + ' = a' + i + ' >>> 13;');
+  }
+  for (i = 0; i < blen; i++) {
+    src.push('var b' + i + ' = b[' + i + '] | 0;');
+    src.push('var bl' + i + ' = b' + i + ' & 0x1fff;');
+    src.push('var bh' + i + ' = b' + i + ' >>> 13;');
+  }
+  src.push('');
+  src.push('out.negative = self.negative ^ num.negative;');
+  src.push('out.length = ' + len + ';');
+
+  for (var k = 0; k < len; k++) {
+    var minJ = Math.max(0, k - alen + 1);
+    var maxJ = Math.min(k, blen - 1);
+
+    src.push('\/* k = ' + k + ' *\/');
+    src.push('var w' + k + ' = c;');
+    src.push('c = 0;');
+    for (var j = minJ; j <= maxJ; j++) {
+      i = k - j;
+
+      src.push('lo = Math.imul(al' + i + ', bl' + j + ');');
+      src.push('mid = Math.imul(al' + i + ', bh' + j + ');');
+      src.push('mid = (mid + Math.imul(ah' + i + ', bl' + j + ')) | 0;');
+      src.push('hi = Math.imul(ah' + i + ', bh' + j + ');');
+
+      src.push('w' + k + ' = (w' + k + ' + lo) | 0;');
+      src.push('w' + k + ' = (w' + k + ' + ((mid & 0x1fff) << 13)) | 0;');
+      src.push('c = (c + hi) | 0;');
+      src.push('c = (c + (mid >>> 13)) | 0;');
+      src.push('c = (c + (w' + k + ' >>> 26)) | 0;');
+      src.push('w' + k + ' &= 0x3ffffff;');
+    }
+  }
+  // Store in separate step for better memory access
+  for (k = 0; k < len; k++) {
+    src.push('o[' + k + '] = w' + k + ';');
+  }
+  src.push('if (c !== 0) {',
+           '  o[' + k + '] = c;',
+           '  out.length++;',
+           '}',
+           'return out;');
+
+  return src.join('\n');
+}
+
+console.log(genCombMulTo(10, 10));

package/node_modules/create-ecdh/node_modules/bn.js/util/genCombMulTo10.js

@@ -0,0 +1,65 @@
+'use strict';
+
+function genCombMulTo (alen, blen) {
+  var len = alen + blen - 1;
+  var src = [
+    'var a = self.words;',
+    'var b = num.words;',
+    'var o = out.words;',
+    'var c = 0;',
+    'var lo;',
+    'var mid;',
+    'var hi;'
+  ];
+  for (var i = 0; i < alen; i++) {
+    src.push('var a' + i + ' = a[' + i + '] | 0;');
+    src.push('var al' + i + ' = a' + i + ' & 0x1fff;');
+    src.push('var ah' + i + ' = a' + i + ' >>> 13;');
+  }
+  for (i = 0; i < blen; i++) {
+    src.push('var b' + i + ' = b[' + i + '] | 0;');
+    src.push('var bl' + i + ' = b' + i + ' & 0x1fff;');
+    src.push('var bh' + i + ' = b' + i + ' >>> 13;');
+  }
+  src.push('');
+  src.push('out.negative = self.negative ^ num.negative;');
+  src.push('out.length = ' + len + ';');
+
+  for (var k = 0; k < len; k++) {
+    var minJ = Math.max(0, k - alen + 1);
+    var maxJ = Math.min(k, blen - 1);
+
+    src.push('\/* k = ' + k + ' *\/');
+    src.push('lo = Math.imul(al' + (k - minJ) + ', bl' + minJ + ');');
+    src.push('mid = Math.imul(al' + (k - minJ) + ', bh' + minJ + ');');
+    src.push(
+        'mid = (mid + Math.imul(ah' + (k - minJ) + ', bl' + minJ + ')) | 0;');
+    src.push('hi = Math.imul(ah' + (k - minJ) + ', bh' + minJ + ');');
+
+    for (var j = minJ + 1; j <= maxJ; j++) {
+      i = k - j;
+
+      src.push('lo = (lo + Math.imul(al' + i + ', bl' + j + ')) | 0;');
+      src.push('mid = (mid + Math.imul(al' + i + ', bh' + j + ')) | 0;');
+      src.push('mid = (mid + Math.imul(ah' + i + ', bl' + j + ')) | 0;');
+      src.push('hi = (hi + Math.imul(ah' + i + ', bh' + j + ')) | 0;');
+    }
+
+    src.push('var w' + k + ' = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;');
+    src.push('c = (((hi + (mid >>> 13)) | 0) + (w' + k + ' >>> 26)) | 0;');
+    src.push('w' + k + ' &= 0x3ffffff;');
+  }
+  // Store in separate step for better memory access
+  for (k = 0; k < len; k++) {
+    src.push('o[' + k + '] = w' + k + ';');
+  }
+  src.push('if (c !== 0) {',
+           '  o[' + k + '] = c;',
+           '  out.length++;',
+           '}',
+           'return out;');
+
+  return src.join('\n');
+}
+
+console.log(genCombMulTo(10, 10));

package/node_modules/create-ecdh/package.json

@@ -25,7 +25,7 @@
   "homepage": "https://github.com/crypto-browserify/createECDH",
   "dependencies": {
     "bn.js": "^4.1.0",
-    "elliptic": "^6.5.3"
+    "elliptic": "^6.6.1"
   },
   "devDependencies": {
     "tap-spec": "^1.0.1",

package/package.json

@@ -2,7 +2,7 @@
   "name": "meteor-node-stubs",
   "author": "Ben Newman <ben@meteor.com>",
   "description": "Stub implementations of Node built-in modules, a la Browserify",
-  "version": "1.2.13",
+  "version": "1.2.14",
   "main": "index.js",
   "license": "MIT",
   "homepage": "https://github.com/meteor/meteor/blob/devel/npm-packages/meteor-node-stubs/README.md",
@@ -11,7 +11,7 @@
     "prepare": "node scripts/build-deps.js"
   },
   "dependencies": {
-    "@meteorjs/crypto-browserify": "^3.12.1",
+    "@meteorjs/crypto-browserify": "^3.12.2",
     "assert": "^2.1.0",
     "browserify-zlib": "^0.2.0",
     "buffer": "^5.7.1",

package/node_modules/@meteorjs/crypto-browserify/.idea/crypto-browserify.iml

@@ -1,12 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<module type="WEB_MODULE" version="4">
-  <component name="NewModuleRootManager">
-    <content url="file://$MODULE_DIR$">
-      <excludeFolder url="file://$MODULE_DIR$/.tmp" />
-      <excludeFolder url="file://$MODULE_DIR$/temp" />
-      <excludeFolder url="file://$MODULE_DIR$/tmp" />
-    </content>
-    <orderEntry type="inheritedJdk" />
-    <orderEntry type="sourceFolder" forTests="false" />
-  </component>
-</module>

package/node_modules/@meteorjs/crypto-browserify/.idea/inspectionProfiles/Project_Default.xml

@@ -1,6 +0,0 @@
-<component name="InspectionProjectProfileManager">
-  <profile version="1.0">
-    <option name="myName" value="Project Default" />
-    <inspection_tool class="Eslint" enabled="true" level="WARNING" enabled_by_default="true" />
-  </profile>
-</component>

package/node_modules/@meteorjs/crypto-browserify/.idea/modules.xml

@@ -1,8 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="ProjectModuleManager">
-    <modules>
-      <module fileurl="file://$PROJECT_DIR$/.idea/crypto-browserify.iml" filepath="$PROJECT_DIR$/.idea/crypto-browserify.iml" />
-    </modules>
-  </component>
-</project>

package/node_modules/@meteorjs/crypto-browserify/.idea/vcs.xml

@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project version="4">
-  <component name="VcsDirectoryMappings">
-    <mapping directory="" vcs="Git" />
-  </component>
-</project>