From ea07097855440e0495b3f3690f3ce28de97eb14e Mon Sep 17 00:00:00 2001 From: fboucquez Date: Mon, 2 Dec 2024 08:56:22 -0300 Subject: [PATCH 1/4] feat: initEccLib skip verification --- src/ecc_lib.d.ts | 3 ++- src/ecc_lib.js | 8 +++++--- ts_src/ecc_lib.ts | 11 ++++++++--- 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/src/ecc_lib.d.ts b/src/ecc_lib.d.ts index abb750a32..382ad4aa0 100644 --- a/src/ecc_lib.d.ts +++ b/src/ecc_lib.d.ts @@ -5,8 +5,9 @@ import { TinySecp256k1Interface } from './types'; * If `eccLib` is a new instance, it will be verified before setting it as the active library. * * @param eccLib The instance of the ECC library to initialize. + * @param skipVerification If the ecc verification should not be executed. */ -export declare function initEccLib(eccLib: TinySecp256k1Interface | undefined): void; +export declare function initEccLib(eccLib: TinySecp256k1Interface | undefined, skipVerification?: boolean): void; /** * Retrieves the ECC Library instance. * Throws an error if the ECC Library is not provided. diff --git a/src/ecc_lib.js b/src/ecc_lib.js index 22202da98..fe1905eec 100644 --- a/src/ecc_lib.js +++ b/src/ecc_lib.js @@ -8,14 +8,16 @@ const _ECCLIB_CACHE = {}; * If `eccLib` is a new instance, it will be verified before setting it as the active library. * * @param eccLib The instance of the ECC library to initialize. + * @param skipVerification If the ecc verification should not be executed. */ -function initEccLib(eccLib) { +function initEccLib(eccLib, skipVerification) { if (!eccLib) { // allow clearing the library _ECCLIB_CACHE.eccLib = eccLib; } else if (eccLib !== _ECCLIB_CACHE.eccLib) { - // new instance, verify it - verifyEcc(eccLib); + if (!skipVerification) + // new instance, verify it + verifyEcc(eccLib); _ECCLIB_CACHE.eccLib = eccLib; } } diff --git a/ts_src/ecc_lib.ts b/ts_src/ecc_lib.ts index fbd1fcdb8..e2423d983 100644 --- a/ts_src/ecc_lib.ts +++ b/ts_src/ecc_lib.ts @@ -8,14 +8,19 @@ const _ECCLIB_CACHE: { eccLib?: TinySecp256k1Interface } = {}; * If `eccLib` is a new instance, it will be verified before setting it as the active library. * * @param eccLib The instance of the ECC library to initialize. + * @param skipVerification If the ecc verification should not be executed. */ -export function initEccLib(eccLib: TinySecp256k1Interface | undefined): void { +export function initEccLib( + eccLib: TinySecp256k1Interface | undefined, + skipVerification?: boolean, +): void { if (!eccLib) { // allow clearing the library _ECCLIB_CACHE.eccLib = eccLib; } else if (eccLib !== _ECCLIB_CACHE.eccLib) { - // new instance, verify it - verifyEcc(eccLib!); + if (!skipVerification) + // new instance, verify it + verifyEcc(eccLib!); _ECCLIB_CACHE.eccLib = eccLib; } } From 53dd7caf9b31acd8712d41a00ca5e7a672bd923c Mon Sep 17 00:00:00 2001 From: fboucquez Date: Mon, 2 Dec 2024 17:08:38 -0300 Subject: [PATCH 2/4] feedback fix, added tests --- src/ecc_lib.d.ts | 6 ++++-- src/ecc_lib.js | 4 ++-- test/ecc_lib.spec.ts | 22 ++++++++++++++++++++++ ts_src/ecc_lib.ts | 6 +++--- 4 files changed, 31 insertions(+), 7 deletions(-) create mode 100644 test/ecc_lib.spec.ts diff --git a/src/ecc_lib.d.ts b/src/ecc_lib.d.ts index 382ad4aa0..12b83d1a9 100644 --- a/src/ecc_lib.d.ts +++ b/src/ecc_lib.d.ts @@ -5,9 +5,11 @@ import { TinySecp256k1Interface } from './types'; * If `eccLib` is a new instance, it will be verified before setting it as the active library. * * @param eccLib The instance of the ECC library to initialize. - * @param skipVerification If the ecc verification should not be executed. + * @param skipVerification Use {DANGER_DO_NOT_VERIFY_ECCLIB:true} if ecc verification should not be executed. Not recommended! */ -export declare function initEccLib(eccLib: TinySecp256k1Interface | undefined, skipVerification?: boolean): void; +export declare function initEccLib(eccLib: TinySecp256k1Interface | undefined, skipVerification?: { + DANGER_DO_NOT_VERIFY_ECCLIB: boolean; +}): void; /** * Retrieves the ECC Library instance. * Throws an error if the ECC Library is not provided. diff --git a/src/ecc_lib.js b/src/ecc_lib.js index fe1905eec..aae264f05 100644 --- a/src/ecc_lib.js +++ b/src/ecc_lib.js @@ -8,14 +8,14 @@ const _ECCLIB_CACHE = {}; * If `eccLib` is a new instance, it will be verified before setting it as the active library. * * @param eccLib The instance of the ECC library to initialize. - * @param skipVerification If the ecc verification should not be executed. + * @param skipVerification Use {DANGER_DO_NOT_VERIFY_ECCLIB:true} if ecc verification should not be executed. Not recommended! */ function initEccLib(eccLib, skipVerification) { if (!eccLib) { // allow clearing the library _ECCLIB_CACHE.eccLib = eccLib; } else if (eccLib !== _ECCLIB_CACHE.eccLib) { - if (!skipVerification) + if (!skipVerification?.DANGER_DO_NOT_VERIFY_ECCLIB) // new instance, verify it verifyEcc(eccLib); _ECCLIB_CACHE.eccLib = eccLib; diff --git a/test/ecc_lib.spec.ts b/test/ecc_lib.spec.ts new file mode 100644 index 000000000..e8bd2a41e --- /dev/null +++ b/test/ecc_lib.spec.ts @@ -0,0 +1,22 @@ +import { initEccLib } from '../src'; +import { describe, test } from 'mocha'; +import * as assert from 'assert'; + +describe(`initEccLib`, () => { + beforeEach(() => { + initEccLib(undefined); + }); + + test('initEccLib should fail when invalid', () => { + assert.throws(() => { + initEccLib({ isXOnlyPoint: () => false } as any); + }, 'Error: ecc library invalid'); + }); + + test('initEccLib should not fail when DANGER_DO_NOT_VERIFY_ECCLIB = true', () => { + initEccLib({ isXOnlyPoint: () => false } as any, { + DANGER_DO_NOT_VERIFY_ECCLIB: true, + }); + assert.ok('it does not fail, verification is excluded'); + }); +}); diff --git a/ts_src/ecc_lib.ts b/ts_src/ecc_lib.ts index e2423d983..72f43754f 100644 --- a/ts_src/ecc_lib.ts +++ b/ts_src/ecc_lib.ts @@ -8,17 +8,17 @@ const _ECCLIB_CACHE: { eccLib?: TinySecp256k1Interface } = {}; * If `eccLib` is a new instance, it will be verified before setting it as the active library. * * @param eccLib The instance of the ECC library to initialize. - * @param skipVerification If the ecc verification should not be executed. + * @param skipVerification Use {DANGER_DO_NOT_VERIFY_ECCLIB:true} if ecc verification should not be executed. Not recommended! */ export function initEccLib( eccLib: TinySecp256k1Interface | undefined, - skipVerification?: boolean, + skipVerification?: { DANGER_DO_NOT_VERIFY_ECCLIB: boolean }, ): void { if (!eccLib) { // allow clearing the library _ECCLIB_CACHE.eccLib = eccLib; } else if (eccLib !== _ECCLIB_CACHE.eccLib) { - if (!skipVerification) + if (!skipVerification?.DANGER_DO_NOT_VERIFY_ECCLIB) // new instance, verify it verifyEcc(eccLib!); _ECCLIB_CACHE.eccLib = eccLib; From 7dc2fda986be0cbdd56fb01f07e75b87c56f77c4 Mon Sep 17 00:00:00 2001 From: fboucquez Date: Mon, 2 Dec 2024 17:21:44 -0300 Subject: [PATCH 3/4] rename param to opts --- src/ecc_lib.d.ts | 4 ++-- src/ecc_lib.js | 6 +++--- ts_src/ecc_lib.ts | 6 +++--- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/src/ecc_lib.d.ts b/src/ecc_lib.d.ts index 12b83d1a9..abe31ed95 100644 --- a/src/ecc_lib.d.ts +++ b/src/ecc_lib.d.ts @@ -5,9 +5,9 @@ import { TinySecp256k1Interface } from './types'; * If `eccLib` is a new instance, it will be verified before setting it as the active library. * * @param eccLib The instance of the ECC library to initialize. - * @param skipVerification Use {DANGER_DO_NOT_VERIFY_ECCLIB:true} if ecc verification should not be executed. Not recommended! + * @param opts Extra initialization options. Use {DANGER_DO_NOT_VERIFY_ECCLIB:true} if ecc verification should not be executed. Not recommended! */ -export declare function initEccLib(eccLib: TinySecp256k1Interface | undefined, skipVerification?: { +export declare function initEccLib(eccLib: TinySecp256k1Interface | undefined, opts?: { DANGER_DO_NOT_VERIFY_ECCLIB: boolean; }): void; /** diff --git a/src/ecc_lib.js b/src/ecc_lib.js index aae264f05..8431956cc 100644 --- a/src/ecc_lib.js +++ b/src/ecc_lib.js @@ -8,14 +8,14 @@ const _ECCLIB_CACHE = {}; * If `eccLib` is a new instance, it will be verified before setting it as the active library. * * @param eccLib The instance of the ECC library to initialize. - * @param skipVerification Use {DANGER_DO_NOT_VERIFY_ECCLIB:true} if ecc verification should not be executed. Not recommended! + * @param opts Extra initialization options. Use {DANGER_DO_NOT_VERIFY_ECCLIB:true} if ecc verification should not be executed. Not recommended! */ -function initEccLib(eccLib, skipVerification) { +function initEccLib(eccLib, opts) { if (!eccLib) { // allow clearing the library _ECCLIB_CACHE.eccLib = eccLib; } else if (eccLib !== _ECCLIB_CACHE.eccLib) { - if (!skipVerification?.DANGER_DO_NOT_VERIFY_ECCLIB) + if (!opts?.DANGER_DO_NOT_VERIFY_ECCLIB) // new instance, verify it verifyEcc(eccLib); _ECCLIB_CACHE.eccLib = eccLib; diff --git a/ts_src/ecc_lib.ts b/ts_src/ecc_lib.ts index 72f43754f..07946dd7f 100644 --- a/ts_src/ecc_lib.ts +++ b/ts_src/ecc_lib.ts @@ -8,17 +8,17 @@ const _ECCLIB_CACHE: { eccLib?: TinySecp256k1Interface } = {}; * If `eccLib` is a new instance, it will be verified before setting it as the active library. * * @param eccLib The instance of the ECC library to initialize. - * @param skipVerification Use {DANGER_DO_NOT_VERIFY_ECCLIB:true} if ecc verification should not be executed. Not recommended! + * @param opts Extra initialization options. Use {DANGER_DO_NOT_VERIFY_ECCLIB:true} if ecc verification should not be executed. Not recommended! */ export function initEccLib( eccLib: TinySecp256k1Interface | undefined, - skipVerification?: { DANGER_DO_NOT_VERIFY_ECCLIB: boolean }, + opts?: { DANGER_DO_NOT_VERIFY_ECCLIB: boolean }, ): void { if (!eccLib) { // allow clearing the library _ECCLIB_CACHE.eccLib = eccLib; } else if (eccLib !== _ECCLIB_CACHE.eccLib) { - if (!skipVerification?.DANGER_DO_NOT_VERIFY_ECCLIB) + if (!opts?.DANGER_DO_NOT_VERIFY_ECCLIB) // new instance, verify it verifyEcc(eccLib!); _ECCLIB_CACHE.eccLib = eccLib; From 00c3f59f5f96960e3438310550f4c6c44bf0836a Mon Sep 17 00:00:00 2001 From: fboucquez Date: Tue, 3 Dec 2024 10:52:55 -0300 Subject: [PATCH 4/4] update version and changelog --- CHANGELOG.md | 4 ++++ package-lock.json | 4 ++-- package.json | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6fdcdca38..9ba9c3bab 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,7 @@ +# 6.1.7 +__added__ +- skip ecc library verification via DANGER_DO_NOT_VERIFY_ECCLIB flag + # 6.1.6 __fixed__ - Fix sighash treatment when signing taproot script sign scripts using Psbt (#2104) diff --git a/package-lock.json b/package-lock.json index 057cebca1..c7e89bad2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "bitcoinjs-lib", - "version": "6.1.6", + "version": "6.1.7", "lockfileVersion": 2, "requires": true, "packages": { "": { "name": "bitcoinjs-lib", - "version": "6.1.6", + "version": "6.1.7", "license": "MIT", "dependencies": { "@noble/hashes": "^1.2.0", diff --git a/package.json b/package.json index 77f8bce1a..70998cdf1 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "bitcoinjs-lib", - "version": "6.1.6", + "version": "6.1.7", "description": "Client-side Bitcoin JavaScript library", "main": "./src/index.js", "types": "./src/index.d.ts",