paulmillr / noble-hashes

Audited & minimal JS implementation of hash functions, MACs and KDFs.
https://paulmillr.com/noble
MIT License
545 stars 46 forks source link

`isPlainObject` check fails in serverless env #70

Closed aulneau closed 1 year ago

aulneau commented 1 year ago

When trying to use some of these hashing functions in the context of a serverless environment, such as vercel or cloudfare, this function

https://github.com/paulmillr/noble-hashes/blob/54c3197fc53bbfa4521b6883eed0e7bd1430beab/src/utils.ts#L163

fails to accept this object {c:2048,dkLen:64} as a plain object.

I have followed it down to this line:

obj.constructor === Object never being true. I'd suggest something like this instead:

obj.constructor.name === 'Object'

aulneau commented 1 year ago

ah, applies to btc-signer, too:

Wrong object type for transaction options: [object Object]

aulneau commented 1 year ago

It's most likely the case that there are different Object instances in these environments, which is why the check is failing

paulmillr commented 1 year ago

I think constructor.name was unreliable 10 years ago. Isn't it still? What about minification? Are you confident the solution would work, did you test it?

paulmillr commented 1 year ago

We have other checks, like: a instanceof Uint8Array, which, I assume, would also fail in the scenario.

aulneau commented 1 year ago

I have tested it: https://github.com/aulneau/noble-edge-bug/blob/main/src/pages/api/index.ts

Here is a reproduction. I'm not familiar with the reliability of constructor.name or not unfortunately.

aulneau commented 1 year ago

@paulmillr anything i can do to help move this on?

paulmillr commented 1 year ago

I think we can remove obj.constructor === Object check. Object.prototype.toString.call is already done. That would make it return different result for ({__proto__: []}), but if tests pass, I think it could work.

The function is used in only a few places.

paulmillr commented 1 year ago

@aulneau fixed!