Add safe-buffer dependency, replace deprecated Buffer usages with Buffer.from() (also fixes linting)

Author: holgerd77

index.js

@@ -1,3 +1,4 @@
+var Buffer = require('safe-buffer').Buffer
 var ethUtil = require('ethereumjs-util')
 var crypto = require('crypto')
 var scryptsy = require('scrypt.js')
@@ -122,13 +123,13 @@ Wallet.prototype.toV3 = function (password, opts) {
   if (kdf === 'pbkdf2') {
     kdfparams.c = opts.c || 262144
     kdfparams.prf = 'hmac-sha256'
-    derivedKey = crypto.pbkdf2Sync(new Buffer(password), salt, kdfparams.c, kdfparams.dklen, 'sha256')
+    derivedKey = crypto.pbkdf2Sync(Buffer.from(password), salt, kdfparams.c, kdfparams.dklen, 'sha256')
   } else if (kdf === 'scrypt') {
     // FIXME: support progress reporting callback
     kdfparams.n = opts.n || 262144
     kdfparams.r = opts.r || 8
     kdfparams.p = opts.p || 1
-    derivedKey = scryptsy(new Buffer(password), salt, kdfparams.n, kdfparams.r, kdfparams.p, kdfparams.dklen)
+    derivedKey = scryptsy(Buffer.from(password), salt, kdfparams.n, kdfparams.r, kdfparams.p, kdfparams.dklen)
   } else {
     throw new Error('Unsupported kdf')
   }
@@ -140,7 +141,7 @@ Wallet.prototype.toV3 = function (password, opts) {
 
   var ciphertext = Buffer.concat([ cipher.update(this.privKey), cipher.final() ])
 
-  var mac = ethUtil.sha3(Buffer.concat([ derivedKey.slice(16, 32), new Buffer(ciphertext, 'hex') ]))
+  var mac = ethUtil.sha3(Buffer.concat([ derivedKey.slice(16, 32), Buffer.from(ciphertext, 'hex') ]))
 
   return {
     version: 3,
@@ -224,17 +225,17 @@ Wallet.fromV1 = function (input, password) {
   }
 
   var kdfparams = json.Crypto.KeyHeader.KdfParams
-  var derivedKey = scryptsy(new Buffer(password), new Buffer(json.Crypto.Salt, 'hex'), kdfparams.N, kdfparams.R, kdfparams.P, kdfparams.DkLen)
+  var derivedKey = scryptsy(Buffer.from(password), Buffer.from(json.Crypto.Salt, 'hex'), kdfparams.N, kdfparams.R, kdfparams.P, kdfparams.DkLen)
 
-  var ciphertext = new Buffer(json.Crypto.CipherText, 'hex')
+  var ciphertext = Buffer.from(json.Crypto.CipherText, 'hex')
 
   var mac = ethUtil.sha3(Buffer.concat([ derivedKey.slice(16, 32), ciphertext ]))
 
   if (mac.toString('hex') !== json.Crypto.MAC) {
     throw new Error('Key derivation failed - possibly wrong passphrase')
   }
 
-  var decipher = crypto.createDecipheriv('aes-128-cbc', ethUtil.sha3(derivedKey.slice(0, 16)).slice(0, 16), new Buffer(json.Crypto.IV, 'hex'))
+  var decipher = crypto.createDecipheriv('aes-128-cbc', ethUtil.sha3(derivedKey.slice(0, 16)).slice(0, 16), Buffer.from(json.Crypto.IV, 'hex'))
   var seed = decipherBuffer(decipher, ciphertext)
 
   return new Wallet(seed)
@@ -254,27 +255,27 @@ Wallet.fromV3 = function (input, password, nonStrict) {
     kdfparams = json.crypto.kdfparams
 
     // FIXME: support progress reporting callback
-    derivedKey = scryptsy(new Buffer(password), new Buffer(kdfparams.salt, 'hex'), kdfparams.n, kdfparams.r, kdfparams.p, kdfparams.dklen)
+    derivedKey = scryptsy(Buffer.from(password), Buffer.from(kdfparams.salt, 'hex'), kdfparams.n, kdfparams.r, kdfparams.p, kdfparams.dklen)
   } else if (json.crypto.kdf === 'pbkdf2') {
     kdfparams = json.crypto.kdfparams
 
     if (kdfparams.prf !== 'hmac-sha256') {
       throw new Error('Unsupported parameters to PBKDF2')
     }
 
-    derivedKey = crypto.pbkdf2Sync(new Buffer(password), new Buffer(kdfparams.salt, 'hex'), kdfparams.c, kdfparams.dklen, 'sha256')
+    derivedKey = crypto.pbkdf2Sync(Buffer.from(password), Buffer.from(kdfparams.salt, 'hex'), kdfparams.c, kdfparams.dklen, 'sha256')
   } else {
     throw new Error('Unsupported key derivation scheme')
   }
 
-  var ciphertext = new Buffer(json.crypto.ciphertext, 'hex')
+  var ciphertext = Buffer.from(json.crypto.ciphertext, 'hex')
 
   var mac = ethUtil.sha3(Buffer.concat([ derivedKey.slice(16, 32), ciphertext ]))
   if (mac.toString('hex') !== json.crypto.mac) {
     throw new Error('Key derivation failed - possibly wrong passphrase')
   }
 
-  var decipher = crypto.createDecipheriv(json.crypto.cipher, derivedKey.slice(0, 16), new Buffer(json.crypto.cipherparams.iv, 'hex'))
+  var decipher = crypto.createDecipheriv(json.crypto.cipher, derivedKey.slice(0, 16), Buffer.from(json.crypto.cipherparams.iv, 'hex'))
   var seed = decipherBuffer(decipher, ciphertext, 'hex')
 
   return new Wallet(seed)
@@ -288,7 +289,7 @@ Wallet.fromEthSale = function (input, password) {
   assert(typeof password === 'string')
   var json = (typeof input === 'object') ? input : JSON.parse(input)
 
-  var encseed = new Buffer(json.encseed, 'hex')
+  var encseed = Buffer.from(json.encseed, 'hex')
 
   // key derivation
   var derivedKey = crypto.pbkdf2Sync(password, password, 2000, 32, 'sha256').slice(0, 16)

package.json

@@ -30,15 +30,16 @@
     "bs58check": "^1.0.8",
     "ethereumjs-util": "^4.4.0",
     "hdkey": "^0.7.0",
+    "safe-buffer": "^5.1.1",
     "scrypt.js": "^0.2.0",
-    "uuid": "^2.0.1",
-    "utf8": "^2.1.1"
+    "utf8": "^2.1.1",
+    "uuid": "^2.0.1"
   },
   "devDependencies": {
     "coveralls": "^2.11.4",
     "istanbul": "^0.4.1",
     "mocha": "^2.3.4",
-    "standard": "^5.4.1"
+    "standard": "^10.0.0"
   },
   "standard": {
     "globals": [

provider-engine.js

@@ -14,10 +14,10 @@ function WalletSubprovider (wallet, opts) {
 
   opts.getPrivateKey = function (address, cb) {
     if (address !== wallet.getAddressString()) {
-      return cb('Account not found')
+      cb(new Error('Account not found'))
+    } else {
+      cb(null, wallet.getPrivateKey())
     }
-
-    cb(null, wallet.getPrivateKey())
   }
 
   WalletSubprovider.super_.call(this, opts)

test/hdkey.js

@@ -1,8 +1,9 @@
 var assert = require('assert')
 var HDKey = require('../hdkey.js')
+var Buffer = require('safe-buffer').Buffer
 
 // from BIP39 mnemonic: awake book subject inch gentle blur grant damage process float month clown
-var fixtureseed = new Buffer('747f302d9c916698912d5f70be53a6cf53bc495803a5523d3a7c3afa2afba94ec3803f838b3e1929ab5481f9da35441372283690fdcf27372c38f40ba134fe03', 'hex')
+var fixtureseed = Buffer.from('747f302d9c916698912d5f70be53a6cf53bc495803a5523d3a7c3afa2afba94ec3803f838b3e1929ab5481f9da35441372283690fdcf27372c38f40ba134fe03', 'hex')
 var fixturehd = HDKey.fromMasterSeed(fixtureseed)
 
 describe('.fromMasterSeed()', function () {

test/index.js

@@ -1,9 +1,10 @@
 var assert = require('assert')
+var Buffer = require('safe-buffer').Buffer
 var Wallet = require('../')
 var Thirdparty = require('../thirdparty.js')
 var ethUtil = require('ethereumjs-util')
 
-var fixturekey = new Buffer('efca4cdd31923b50f4214af5d2ae10e7ac45a5019e9431cc195482d707485378', 'hex')
+var fixturekey = Buffer.from('efca4cdd31923b50f4214af5d2ae10e7ac45a5019e9431cc195482d707485378', 'hex')
 var fixturewallet = Wallet.fromPrivateKey(fixturekey)
 
 describe('.getPrivateKey()', function () {
@@ -12,7 +13,7 @@ describe('.getPrivateKey()', function () {
   })
   it('should fail', function () {
     assert.throws(function () {
-      Wallet.fromPrivateKey(new Buffer('001122', 'hex'))
+      Wallet.fromPrivateKey(Buffer.from('001122', 'hex'))
     }, /^Error: Private key does not satisfy the curve requirements \(ie. it is invalid\)$/)
   })
 })
@@ -54,18 +55,18 @@ describe('.getChecksumAddressString()', function () {
 })
 
 describe('public key only wallet', function () {
-  var pubKey = new Buffer('5d4392f450262b276652c1fc037606abac500f3160830ce9df53aa70d95ce7cfb8b06010b2f3691c78c65c21eb4cf3dfdbfc0745d89b664ee10435bb3a0f906c', 'hex')
+  var pubKey = Buffer.from('5d4392f450262b276652c1fc037606abac500f3160830ce9df53aa70d95ce7cfb8b06010b2f3691c78c65c21eb4cf3dfdbfc0745d89b664ee10435bb3a0f906c', 'hex')
   it('.fromPublicKey() should work', function () {
     assert.equal(Wallet.fromPublicKey(pubKey).getPublicKey().toString('hex'),
       '5d4392f450262b276652c1fc037606abac500f3160830ce9df53aa70d95ce7cfb8b06010b2f3691c78c65c21eb4cf3dfdbfc0745d89b664ee10435bb3a0f906c')
   })
   it('.fromPublicKey() should not accept compressed keys in strict mode', function () {
     assert.throws(function () {
-      Wallet.fromPublicKey(new Buffer('030639797f6cc72aea0f3d309730844a9e67d9f1866e55845c5f7e0ab48402973d', 'hex'))
+      Wallet.fromPublicKey(Buffer.from('030639797f6cc72aea0f3d309730844a9e67d9f1866e55845c5f7e0ab48402973d', 'hex'))
     }, /^Error: Invalid public key$/)
   })
   it('.fromPublicKey() should accept compressed keys in non-strict mode', function () {
-    var tmp = new Buffer('030639797f6cc72aea0f3d309730844a9e67d9f1866e55845c5f7e0ab48402973d', 'hex')
+    var tmp = Buffer.from('030639797f6cc72aea0f3d309730844a9e67d9f1866e55845c5f7e0ab48402973d', 'hex')
     assert.equal(Wallet.fromPublicKey(tmp, true).getPublicKey().toString('hex'),
       '0639797f6cc72aea0f3d309730844a9e67d9f1866e55845c5f7e0ab48402973defa5cb69df462bcc6d73c31e1c663c225650e80ef14a507b203f2a12aea55bc1')
   })
@@ -126,19 +127,19 @@ describe('.getV3Filename()', function () {
 })
 
 describe('.toV3()', function () {
-  var salt = new Buffer('dc9e4a98886738bd8aae134a1f89aaa5a502c3fbd10e336136d4d5fe47448ad6', 'hex')
-  var iv = new Buffer('cecacd85e9cb89788b5aab2f93361233', 'hex')
-  var uuid = new Buffer('7e59dc028d42d09db29aa8a0f862cc81', 'hex')
+  var salt = Buffer.from('dc9e4a98886738bd8aae134a1f89aaa5a502c3fbd10e336136d4d5fe47448ad6', 'hex')
+  var iv = Buffer.from('cecacd85e9cb89788b5aab2f93361233', 'hex')
+  var uuid = Buffer.from('7e59dc028d42d09db29aa8a0f862cc81', 'hex')
 
   it('should work with PBKDF2', function () {
-    var key = new Buffer('efca4cdd31923b50f4214af5d2ae10e7ac45a5019e9431cc195482d707485378', 'hex')
+    var key = Buffer.from('efca4cdd31923b50f4214af5d2ae10e7ac45a5019e9431cc195482d707485378', 'hex')
     var wallet = Wallet.fromPrivateKey(key)
     var w = '{"version":3,"id":"7e59dc02-8d42-409d-b29a-a8a0f862cc81","address":"b14ab53e38da1c172f877dbc6d65e4a1b0474c3c","crypto":{"ciphertext":"01ee7f1a3c8d187ea244c92eea9e332ab0bb2b4c902d89bdd71f80dc384da1be","cipherparams":{"iv":"cecacd85e9cb89788b5aab2f93361233"},"cipher":"aes-128-ctr","kdf":"pbkdf2","kdfparams":{"dklen":32,"salt":"dc9e4a98886738bd8aae134a1f89aaa5a502c3fbd10e336136d4d5fe47448ad6","c":262144,"prf":"hmac-sha256"},"mac":"0c02cd0badfebd5e783e0cf41448f84086a96365fc3456716c33641a86ebc7cc"}}'
     // FIXME: just test for ciphertext and mac?
     assert.equal(wallet.toV3String('testtest', { kdf: 'pbkdf2', uuid: uuid, salt: salt, iv: iv }), w)
   })
   it('should work with Scrypt', function () {
-    var key = new Buffer('efca4cdd31923b50f4214af5d2ae10e7ac45a5019e9431cc195482d707485378', 'hex')
+    var key = Buffer.from('efca4cdd31923b50f4214af5d2ae10e7ac45a5019e9431cc195482d707485378', 'hex')
     var wallet = Wallet.fromPrivateKey(key)
     var w = '{"version":3,"id":"7e59dc02-8d42-409d-b29a-a8a0f862cc81","address":"b14ab53e38da1c172f877dbc6d65e4a1b0474c3c","crypto":{"ciphertext":"c52682025b1e5d5c06b816791921dbf439afe7a053abb9fac19f38a57499652c","cipherparams":{"iv":"cecacd85e9cb89788b5aab2f93361233"},"cipher":"aes-128-ctr","kdf":"scrypt","kdfparams":{"dklen":32,"salt":"dc9e4a98886738bd8aae134a1f89aaa5a502c3fbd10e336136d4d5fe47448ad6","n":262144,"r":8,"p":1},"mac":"27b98c8676dc6619d077453b38db645a4c7c17a3e686ee5adaf53c11ac1b890e"}}'
     this.timeout(180000) // 3minutes

thirdparty.js

@@ -4,6 +4,7 @@ var crypto = require('crypto')
 var scryptsy = require('scrypt.js')
 var utf8 = require('utf8')
 var aesjs = require('aes-js')
+var Buffer = require('safe-buffer').Buffer
 
 function assert (val, msg) {
   if (!val) {
@@ -28,7 +29,7 @@ var Thirdparty = {}
  *
  * FIXME: not optimised at all
  */
-function evp_kdf (data, salt, opts) {
+function evp_kdf (data, salt, opts) { // eslint-disable-line
   // A single EVP iteration, returns `D_i`, where block equlas to `D_(i-1)`
   function iter (block) {
     var hash = crypto.createHash(opts.digest || 'md5')
@@ -53,7 +54,7 @@ function evp_kdf (data, salt, opts) {
 
   var i = 0
   while (Buffer.concat(ret).length < (keysize + ivsize)) {
-    ret[i] = iter((i === 0) ? new Buffer(0) : ret[i - 1])
+    ret[i] = iter((i === 0) ? Buffer.alloc(0) : ret[i - 1])
     i++
   }
 
@@ -67,7 +68,7 @@ function evp_kdf (data, salt, opts) {
 
 // http://stackoverflow.com/questions/25288311/cryptojs-aes-pattern-always-ends-with
 function decodeCryptojsSalt (input) {
-  var ciphertext = new Buffer(input, 'base64')
+  var ciphertext = Buffer.from(input, 'base64')
   if (ciphertext.slice(0, 8).toString() === 'Salted__') {
     return {
       salt: ciphertext.slice(8, 16),
@@ -93,7 +94,7 @@ Thirdparty.fromEtherWallet = function (input, password) {
       throw new Error('Invalid private key length')
     }
 
-    privKey = new Buffer(json.private, 'hex')
+    privKey = Buffer.from(json.private, 'hex')
   } else {
     if (typeof password !== 'string') {
       throw new Error('Password required')
@@ -114,13 +115,13 @@ Thirdparty.fromEtherWallet = function (input, password) {
     }
 
     // derive key/iv using OpenSSL EVP as implemented in CryptoJS
-    var evp = evp_kdf(new Buffer(password), cipher.salt, { keysize: 32, ivsize: 16 })
+    var evp = evp_kdf(Buffer.from(password), cipher.salt, { keysize: 32, ivsize: 16 })
 
     var decipher = crypto.createDecipheriv('aes-256-cbc', evp.key, evp.iv)
-    privKey = decipherBuffer(decipher, new Buffer(cipher.ciphertext))
+    privKey = decipherBuffer(decipher, Buffer.from(cipher.ciphertext))
 
     // NOTE: yes, they've run it through UTF8
-    privKey = new Buffer(utf8.decode(privKey.toString()), 'hex')
+    privKey = Buffer.from(utf8.decode(privKey.toString()), 'hex')
   }
 
   var wallet = new Wallet(privKey)
@@ -133,12 +134,12 @@ Thirdparty.fromEtherWallet = function (input, password) {
 }
 
 Thirdparty.fromEtherCamp = function (passphrase) {
-  return new Wallet(ethUtil.sha3(new Buffer(passphrase)))
+  return new Wallet(ethUtil.sha3(Buffer.from(passphrase)))
 }
 
 Thirdparty.fromKryptoKit = function (entropy, password) {
   function kryptoKitBrokenScryptSeed (buf) {
-    // js-scrypt calls `new Buffer(String(salt), 'utf8')` on the seed even though it is a buffer
+    // js-scrypt calls `Buffer.from(String(salt), 'utf8')` on the seed even though it is a buffer
     //
     // The `buffer`` implementation used does the below transformation (doesn't matches the current version):
     // https://github.com/feross/buffer/blob/67c61181b938b17d10dbfc0a545f713b8bd59de8/index.js
@@ -163,7 +164,7 @@ Thirdparty.fromKryptoKit = function (entropy, password) {
       }
     }
 
-    return new Buffer(res + decodeUtf8Char(tmp))
+    return Buffer.from(res + decodeUtf8Char(tmp))
   }
 
   if (entropy[0] === '#') {
@@ -181,16 +182,16 @@ Thirdparty.fromKryptoKit = function (entropy, password) {
       throw new Error('Password required')
     }
 
-    var encryptedSeed = ethUtil.sha256(new Buffer(entropy.slice(0, 30)))
+    var encryptedSeed = ethUtil.sha256(Buffer.from(entropy.slice(0, 30)))
     var checksum = entropy.slice(30, 46)
 
     var salt = kryptoKitBrokenScryptSeed(encryptedSeed)
-    var aesKey = scryptsy(new Buffer(password, 'utf8'), salt, 16384, 8, 1, 32)
+    var aesKey = scryptsy(Buffer.from(password, 'utf8'), salt, 16384, 8, 1, 32)
 
     /* FIXME: try to use `crypto` instead of `aesjs`
 
     // NOTE: ECB doesn't use the IV, so it can be anything
-    var decipher = crypto.createDecipheriv("aes-256-ecb", aesKey, new Buffer(0))
+    var decipher = crypto.createDecipheriv("aes-256-ecb", aesKey, Buffer.from(0))
 
     // FIXME: this is a clear abuse, but seems to match how ECB in aesjs works
     privKey = Buffer.concat([