audit fixes

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leapwallet/leap-keychain",
-  "version": "0.2.5-beta.1",
+  "version": "0.2.5-beta.4",
   "description": "A javascript library for crypto key management",
   "scripts": {
     "test": "jest",
@@ -72,7 +72,7 @@
     "@typescript-eslint/eslint-plugin": "5.9.1",
     "@typescript-eslint/parser": "5.9.1",
     "eslint": "8.6.0",
-    "jest": "28.1.2",
+    "jest": "29.7.0",
     "prettier": "2.5.1",
     "ts-jest": "28.0.5",
     "typedoc": "0.22.17",

src/encryption-utils/encryption-utils.ts

@@ -1,6 +1,7 @@
 //import CryptoJS from 'crypto-js';
 import { cbc } from '@noble/ciphers/aes';
 import { pbkdf2 } from '@noble/hashes/pbkdf2';
+import { Input } from '@noble/hashes/utils';
 import { randomBytes } from '@noble/ciphers/webcrypto';
 import { sha1 } from '@noble/hashes/sha1';
 import { base64, hex } from '@scure/base';
@@ -45,8 +46,9 @@ const new_iterations = 10_000;
 //   }).toString(CryptoJS.enc.Utf8);
 // };
 
-export const encrypt = (msg: string, pass: string, iterations?: number) => {
+export const encrypt = (msg: string, pass: Input, iterations?: number) => {
   const salt = randomBytes(128 / 8);
+
   const key = pbkdf2(sha1, pass, salt, { c: iterations ?? new_iterations, dkLen: keySize / 8 });
   const iv = randomBytes(128 / 8);
   const stream = cbc(key, iv);
@@ -58,7 +60,7 @@ export const encrypt = (msg: string, pass: string, iterations?: number) => {
   return saltString + ivString + encryptedString;
 };
 
-export const decrypt = (transitmessage: string, pass: string, iterations?: number): string => {
+export const decrypt = (transitmessage: string, pass: Input, iterations?: number): string => {
   const salt = hex.decode(transitmessage.substring(0, 32));
   const iv = hex.decode(transitmessage.substring(32, 64));
   const encrypted = base64.decode(transitmessage.substring(64));

src/index.ts

@@ -16,3 +16,5 @@ export * from './crypto/bip32/hdwallet-token';
 export * from './crypto/ecc/secp256k1';
 export * from './crypto/hashes/hashes';
 export * from './utils/init-crypto';
+export * from './key/wallet-utils';
+export * from './utils/get-hdpath';

src/key/eth-wallet.ts

@@ -127,7 +127,6 @@ export class EthWallet {
       throw new Error(`Address ${signerAddress} not found in wallet`);
     }
     const { ethWallet } = account;
-
     return ethWallet.signTransaction(transaction);
   }
 

src/key/wallet-utils.ts

@@ -5,6 +5,16 @@ import { Wallet } from './wallet';
 import * as base64js from 'base64-js';
 import { bip39Token } from '../crypto/bip39/bip39-token';
 
+/***
+ * Generate a wallet from a mnemonic
+ * @param mnemonic
+ * @param options {
+ *  hdPath: string,
+ *  addressPrefix: string,
+ *  ethWallet: boolean, - if true, it generates an ethereum wallet regardless of cointype
+ *  pubKeyBech32Address: boolean - if true, it generates a bech32 address from public key instead of ethereum address.
+ * }
+ */
 export function generateWalletFromMnemonic(
   mnemonic: string,
   {

src/keychain/keychain.ts

@@ -10,6 +10,7 @@ import { correctMnemonic } from '../utils/correct-mnemonic';
 import { ChainInfo, CreateWalletParams, Key, Keystore, WALLETTYPE } from '../types/keychain';
 import { compressedPublicKey, generateWalletFromMnemonic, generateWalletsFromMnemonic } from '../key/wallet-utils';
 import { convertAddress } from '../utils/bech32-address-converter';
+import { Input } from '@noble/ciphers/utils';
 
 export const KEYCHAIN = 'keystore';
 export const ENCRYPTED_KEYCHAIN = 'encrypted-keystore';
@@ -56,7 +57,7 @@ export class KeyChain {
 
   public static async createNewWalletAccount<T extends string>(
     name: string,
-    password: string,
+    password: Input,
     colorIndex: number,
     chainInfos: ChainInfo[],
   ): Promise<Key<T>> {
@@ -101,7 +102,7 @@ export class KeyChain {
 
   public static async importNewWallet<T extends string>(
     privateKey: string,
-    password: string,
+    password: Input,
     chainInfos: ChainInfo[],
     addressIndex?: number,
     name?: string,
@@ -206,7 +207,7 @@ export class KeyChain {
 
   public static async getSigner<T extends string>(
     walletId: string,
-    password: string,
+    password: Input,
     {
       addressPrefix,
       coinType,
@@ -252,7 +253,7 @@ export class KeyChain {
     storage.set(KEYCHAIN, keychain);
   }
 
-  public static async encrypt<T extends string>(password: string) {
+  public static async encrypt<T extends string>(password: Input) {
     const storage = Container.get(storageToken);
     const keychain = (await storage.get(KEYCHAIN)) as unknown as Keystore<T>;
     const activeWallet = (await storage.get(ACTIVE_WALLET)) as unknown as Key<T>;
@@ -271,7 +272,7 @@ export class KeyChain {
     }
   }
 
-  public static async decrypt(password: string) {
+  public static async decrypt(password: Input) {
     const storage = Container.get(storageToken);
     const encryptedKeychain = (await storage.get(ENCRYPTED_KEYCHAIN)) as unknown as string;
     const encryptedActiveWallet = (await storage.get(ENCRYPTED_ACTIVE_WALLET)) as unknown as string;

src/types/keychain.ts

@@ -21,7 +21,7 @@ export type Keystore<T extends string> = Record<string, Key<T>>;
 export type CreateWalletParams = {
   name: string;
   mnemonic: string;
-  password: string;
+  password: string | Uint8Array;
   addressIndex: number;
   colorIndex: number;
   chainInfos: ChainInfo[];