EOSIO / eosjs-ecc

Elliptic curve cryptography functions: Private Key, Public Key, Signature, AES, Encryption, Decryption
289 stars 120 forks source link

Remove import of old bytebuffer. Can't build a library that includes eosjs-ecc #58

Open sgehrman opened 5 years ago

sgehrman commented 5 years ago

I'm trying to build an NPM package that includes eosjs-ecc. When I build it I get this:

WARNING in ./node_modules/bytebuffer/dist/bytebuffer-node.js Module not found: Error: Can't resolve 'memcpy' in '/home/steve/Documents/GitHub/aikon/ore-js/node_modules/bytebuffer/dist' @ ./node_modules/bytebuffer/dist/bytebuffer-node.js @ ./node_modules/eosjs-ecc/lib/aes.js @ ./node_modules/eosjs-ecc/lib/api_common.js @ ./node_modules/eosjs-ecc/lib/index.js @ ./src/verifier.js @ ./src/index.js

When I try and run a project that includes this library it stops and just gives this error:

(node:17758) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.

eosjs-ecc imports browserify-aes which imports byteBuffer

─┬ eosjs-ecc@4.0.4 │ ├── bigi@1.4.2 │ ├─┬ browserify-aes@1.2.0 │ │ ├── buffer-xor@1.0.3 │ │ ├─┬ cipher-base@1.0.4 │ │ │ ├── inherits@2.0.4 deduped │ │ │ └── safe-buffer@5.1.2 deduped │ │ ├── create-hash@1.2.0 deduped │ │ ├─┬ evp_bytestokey@1.0.3 │ │ │ ├── md5.js@1.3.5 deduped │ │ │ └── safe-buffer@5.1.2 deduped │ │ ├── inherits@2.0.4 deduped │ │ └── safe-buffer@5.1.2 deduped │ ├─┬ bs58@4.0.1 │ │ └─┬ base-x@3.0.5 │ │ └── safe-buffer@5.1.2 deduped │ ├─┬ bytebuffer@5.0.1 │ │ └── long@3.2.0

Is this something you could fix in your library? Get rid or replace browserify-aes?

Thanks

angelol commented 5 years ago

@sgehrman Have a look at our branch: https://github.com/rawrat/eosjs-ecc-priveos

We have replaced browserify-aes with something more secure and it no longer contains bytebuffer.

gnollio commented 5 years ago

I'm having the same issue. Thanks for the alternative @angelol.