tinyhmacmd5 0.1.0 → 0.1.1

package/README.md

@@ -1,11 +1,15 @@
 # Tiny HMAC MD5
 
-A tiny, reliable JavaScript HMAC-MD5 implementation.
+A tiny JavaScript HMAC-MD5 implementation.
 
 The minified browser bundle ([`browser.min.js`](browser.min.js)) is only 1057 bytes.
 
 Preview: https://bddjr.github.io/tinyhmacmd5/
 
+> [!WARNING]  
+> MD5 is cryptographically broken and unsafe for security-sensitive applications.  
+> Do not rely on it for password hashing, digital signatures, or certificate verification.
+
 ## Setup
 
 ### npm
@@ -30,6 +34,10 @@ See https://www.jsdelivr.com/package/npm/tinyhmacmd5
 
 ## Example
 
+> [!WARNING]  
+> Please make sure on your own that the types of input parameters conform to the definitions in [`main.d.ts`](main.d.ts).  
+> If you pass wrong types, it may not throw an error and may produce incorrect results.
+
 HMAC-MD5:
 
 ```js

package/main.d.ts

@@ -4,13 +4,21 @@
  * By default, returns the hash as a lowercase hexadecimal string.  
  * If `raw` is true, returns a Uint8Array.  
  *
- * @param {string | Uint8Array} data The input data to hash. Strings are UTF‑8 encoded.
- * @param {string | Uint8Array | null} [key] Optional HMAC key. When given, HMAC‑MD5 is calculated instead of plain MD5.
+ * @param {string | Uint8Array | Uint8ClampedArray} data The input data to hash. Strings are UTF‑8 encoded.
+ * @param {string | Uint8Array | Uint8ClampedArray | null} [key] Optional HMAC key. When given, HMAC‑MD5 is calculated instead of plain MD5.
  * @param {boolean} [raw] If true, the hash is returned as raw bytes (Uint8Array); otherwise, as a hex string.
  * @returns {string | Uint8Array<ArrayBuffer>} The MD5 (or HMAC‑MD5) digest, either as a hex string or a Uint8Array.
  */
 declare var md5: {
-    (data: string | Uint8Array, key?: string | Uint8Array | null, raw?: false): string;
-    (data: string | Uint8Array, key: string | Uint8Array | null | undefined, raw: true): Uint8Array<ArrayBuffer>;
+    (
+        data: string | Uint8Array | Uint8ClampedArray,
+        key?: string | Uint8Array | Uint8ClampedArray | null,
+        raw?: false
+    ): string;
+    (
+        data: string | Uint8Array | Uint8ClampedArray,
+        key: string | Uint8Array | Uint8ClampedArray | null | undefined,
+        raw: true
+    ): Uint8Array<ArrayBuffer>;
 };
 export default md5;

package/main.js

@@ -125,15 +125,15 @@ let inputToBinl = (
 
 /**
  * @overload
- * @param {string | Uint8Array} data
- * @param {string | Uint8Array | null} [key]
+ * @param {string | Uint8Array | Uint8ClampedArray} data
+ * @param {string | Uint8Array | Uint8ClampedArray | null} [key]
  * @param {false} [raw]
  * @returns {string}
  */
 /**
  * @overload
- * @param {string | Uint8Array} data
- * @param {string | Uint8Array | null | undefined} key
+ * @param {string | Uint8Array | Uint8ClampedArray} data
+ * @param {string | Uint8Array | Uint8ClampedArray | null | undefined} key
  * @param {true} raw
  * @returns {Uint8Array<ArrayBuffer>}
  */
@@ -143,8 +143,8 @@ let inputToBinl = (
  * By default, returns the hash as a lowercase hexadecimal string.  
  * If `raw` is true, returns a Uint8Array.  
  *
- * @param {string | Uint8Array} data The input data to hash. Strings are UTF‑8 encoded.
- * @param {string | Uint8Array | null} [key] Optional HMAC key. When given, HMAC‑MD5 is calculated instead of plain MD5.
+ * @param {string | Uint8Array | Uint8ClampedArray} data The input data to hash. Strings are UTF‑8 encoded.
+ * @param {string | Uint8Array | Uint8ClampedArray | null} [key] Optional HMAC key. When given, HMAC‑MD5 is calculated instead of plain MD5.
  * @param {boolean} [raw] If true, the hash is returned as raw bytes (Uint8Array); otherwise, as a hex string.
  * @returns {string | Uint8Array<ArrayBuffer>} The MD5 (or HMAC‑MD5) digest, either as a hex string or a Uint8Array.
  */
@@ -157,17 +157,17 @@ var md5 = (data, key, raw) => {
   if (hasKey) {
     // HMAC
     let [bkey, keyByteLen] = inputToBinl(key, 0)
-    let pad5cArr = []
+    let opad = []
     if (keyByteLen > 64) {
       bkey = binlMD5(bkey, keyByteLen)
     }
     for (; i;) {
-      bdata[--i] = 0x36363636 ^ bkey[i]
-      pad5cArr[i] = 0x5c5c5c5c ^ bkey[i]
+      bdata[--i] = 0x36363636 ^ bkey[i] // ipad
+      opad[i] = 0x5c5c5c5c ^ bkey[i]
     }
     i = 16
     bdata = binlMD5(bdata, 64 + dataByteLen)
-    bdata.unshift(...pad5cArr)
+    bdata.unshift(...opad)
     dataByteLen = 80
   }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tinyhmacmd5",
-  "version": "0.1.0",
-  "description": "A tiny, reliable JavaScript HMAC-MD5 implementation. The minified browser bundle is only 1057 bytes.",
+  "version": "0.1.1",
+  "description": "A tiny JavaScript HMAC-MD5 implementation. The minified browser bundle is only 1057 bytes.",
   "author": "bddjr",
   "license": "MIT",
   "type": "module",