Merge pull request #311 from massalabs/fix-audit

Fix audit

README.md

@@ -1,6 +1,6 @@
 # Massa-as-sdk
 
-![check-code-coverage](https://img.shields.io/badge/coverage-83%%25-red)
+![check-code-coverage](https://img.shields.io/badge/coverage-%25-red)
 
 Massa-as-sdk is a collection of tools, objects, and functions specifically designed for Massa smart contracts in AssemblyScript. This SDK enables you to import object classes, such as address and storage objects, and use them without having to write them from scratch every time. Additionally, it allows you to use Massa's ABI functions.
 

as-pect-ci.config.js

@@ -1,3 +1,3 @@
 import config from './as-pect.config.js';
-config.coverage = ['assembly/**/*.ts'];
+// config.coverage = ['assembly/**/*.ts']; // disabled for now waiting for as-pect fix
 export default config;

assembly/std/__tests__/context.spec.ts

@@ -8,7 +8,7 @@ import {
   isDeployingContract,
   timestamp,
 } from '../context';
-import { validateAddress } from '../utils';
+import { validateAddress, json2Address } from '../utils';
 
 describe('Context', () => {
   test('ownedAddresses', () => {
@@ -45,4 +45,20 @@ describe('Context', () => {
     const time = timestamp();
     expect(time).toBeGreaterThan(0);
   });
+
+  test('json2Address', () => {
+    const jsonString = '["address1","address2","address3"]';
+    const expectedOutput = [
+      new Address('address1'),
+      new Address('address2'),
+      new Address('address3'),
+    ];
+
+    const result = json2Address(jsonString);
+
+    expect(result.length).toBe(expectedOutput.length);
+    for (let i = 0; i < result.length; i++) {
+      expect(result[i]).toBe(expectedOutput[i]);
+    }
+  });
 });

assembly/std/__tests__/index.spec.ts

@@ -46,6 +46,7 @@ const keySerOk3: StaticArray<u8> = [
 ];
 
 const keysSerKo8: StaticArray<u8> = []; // edge case
+const keysSerKo9: StaticArray<u8> = [0, 0]; // length < 4 (Minimal length)
 
 describe('index tests', () => {
   it('derOpKeys ok 1', () => {
@@ -73,6 +74,11 @@ describe('index tests', () => {
     expect(res8.length).toBe(0);
   });
 
+  it('derOpKeys ko 8', () => {
+    let res9 = derKeys(keysSerKo9);
+    expect(res9.length).toBe(0);
+  });
+
   it('derOpKeys ok 3', () => {
     let res = derKeys(keySerOk3);
     expect(res.length).toBe(1);

assembly/std/context.ts

@@ -30,7 +30,7 @@
 
 import { env } from '../env/index';
 import { Address } from './address';
-import { callerHasWriteAccess, Context } from '.';
+import { callerHasWriteAccess, Context, json2Address } from '.';
 
 /**
  * Determines whether the smart contract is currently being deployed.
@@ -48,27 +48,6 @@ export function isDeployingContract(): bool {
   return callerHasWriteAccess() && Context.callee().notEqual(Context.caller());
 }
 
-/**
- * Returns an array of addresses.
- *
- * Parses a JSON-encoded string of addresses and returns an array of `Address` objects.
- *
- * @remarks
- * This function takes a string containing a JSON-encoded array of addresses
- * (ex: "[address1,address2,...,addressN]") and returns an array of `Address`
- * objects.
- *
- * @param str - A string containing a JSON-encoded array of addresses.
- *
- * @returns An array of `Address` objects, one for each address in the input string.
- */
-function json2Address(str: string): Array<Address> {
-  str = str.substr(1, str.length - 2);
-
-  const a = str.split(',');
-  return a.map<Address>((x) => new Address(x.substring(1, x.length - 1)));
-}
-
 /**
  * Returns the addresses that the current execution context has write access to.
  *

assembly/std/op-datastore/util.ts

@@ -7,6 +7,8 @@
  *
  */
 function getNumberOfKeys(keysSer: StaticArray<u8>): u32 {
+  // check if keysSer is more than 4 bytes
+  assert(keysSer.length >= 4, 'Invalid keysSer length');
   // The first 4 bytes of the input array represent the number of keys
   let arr = new Uint8Array(4);
   arr[0] = keysSer[0];
@@ -46,7 +48,8 @@ function getNumberOfKeys(keysSer: StaticArray<u8>): u32 {
  *
  */
 export function derKeys(keysSer: StaticArray<u8>): Array<StaticArray<u8>> {
-  if (keysSer.length == 0) return [];
+  // check if keysSer is more than 4 bytes (for the number of keys)
+  if (keysSer.length < 4) return [];
 
   const keyCount: u32 = getNumberOfKeys(keysSer);
   const keys = new Array<StaticArray<u8>>(keyCount);

assembly/std/utils/address.ts

@@ -38,3 +38,24 @@ export function validateAddress(address: string): bool {
 export function isAddressEoa(address: string): bool {
   return env.isAddressEoa(address);
 }
+
+/**
+ * Returns an array of addresses.
+ *
+ * Parses a JSON-encoded string of addresses and returns an array of `Address` objects.
+ *
+ * @remarks
+ * This function takes a string containing a JSON-encoded array of addresses
+ * (ex: "[address1,address2,...,addressN]") and returns an array of `Address`
+ * objects.
+ *
+ * @param str - A string containing a JSON-encoded array of addresses.
+ *
+ * @returns An array of `Address` objects, one for each address in the input string.
+ */
+export function json2Address(str: string): Array<Address> {
+  str = str.substring(1, str.length - 1);
+
+  const a = str.split(',');
+  return a.map<Address>((x) => new Address(x.substring(1, x.length - 1)));
+}