diff options
Diffstat (limited to 'node_modules/csrf')
32 files changed, 1685 insertions, 0 deletions
diff --git a/node_modules/csrf/HISTORY.md b/node_modules/csrf/HISTORY.md new file mode 100644 index 0000000..cbccedf --- /dev/null +++ b/node_modules/csrf/HISTORY.md @@ -0,0 +1,86 @@ +3.0.3 / 2016-05-26 +================== + + * deps: tsscmp@1.0.5 + +3.0.2 / 2016-05-22 +================== + + * Use `tsscmp` module for timing-safe token verification + * deps: base64-url@1.2.2 + * deps: uid-safe@2.1.1 + - deps: base64-url@1.2.2 + +3.0.1 / 2016-01-28 +================== + + * deps: rndm@1.2.0 + * deps: uid-safe@2.1.0 + - Use `random-bytes` for byte source + +3.0.0 / 2015-05-09 +================== + + * Remove `tokenize` export + * Remove `tokenize` option + * Return a prototype-based object rather than functions + - This means the resulting functions need to be called as methods + * Throw when missing secret to `tokens.create()` + * deps: uid-safe@~2.0.0 + - Use global `Promise` when returning a promise + +2.0.7 / 2015-05-03 +================== + + * Fix compatibility with `crypto.DEFAULT_ENCODING` global changes + +2.0.6 / 2015-02-13 +================== + + * deps: base64-url@1.2.1 + * deps: uid-safe@~1.1.0 + - Use `crypto.randomBytes`, if available + - deps: base64-url@1.2.1 + +2.0.5 / 2015-01-31 +================== + + * deps: base64-url@1.2.0 + * deps: uid-safe@~1.0.3 + - Fix error branch that would throw + - deps: base64-url@1.2.0 + +2.0.4 / 2015-01-08 +================== + + * deps: uid-safe@~1.0.2 + - Remove dependency on `mz` + +2.0.3 / 2014-12-30 +================== + + * Slight speed improvement for `verify` + * deps: base64-url@1.1.0 + * deps: rndm@~1.1.0 + +2.0.2 / 2014-11-09 +================== + + * deps: scmp@1.0.0 + +2.0.1 / 2014-08-22 +================== + + * Rename module to `csrf` + +2.0.0 / 2014-06-18 +================== + + * Use `uid-safe` module + * Use `base64-url` module + * Remove sync `.secret()` -- use `.secretSync()` instead + +1.0.4 / 2014-06-11 +================== + + * Make sure CSRF tokens are URL safe diff --git a/node_modules/csrf/LICENSE b/node_modules/csrf/LICENSE new file mode 100644 index 0000000..6b774b4 --- /dev/null +++ b/node_modules/csrf/LICENSE @@ -0,0 +1,22 @@ +The MIT License (MIT) + +Copyright (c) 2014 Jonathan Ong <me@jongleberry.com> +Copyright (c) 2015 Douglas Christopher Wilson <doug@somethingdoug.com> + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/node_modules/csrf/README.md b/node_modules/csrf/README.md new file mode 100644 index 0000000..537a02a --- /dev/null +++ b/node_modules/csrf/README.md @@ -0,0 +1,126 @@ +# CSRF + +[![NPM Version][npm-image]][npm-url] +[![NPM Downloads][downloads-image]][downloads-url] +[![Node.js Version][node-image]][node-url] +[![Build Status][travis-image]][travis-url] +[![Test Coverage][coveralls-image]][coveralls-url] + +Logic behind CSRF token creation and verification. + +Read [Understanding-CSRF](https://github.com/pillarjs/understanding-csrf) +for more information on CSRF. Use this module to create custom CSRF middleware. + +Looking for a CSRF framework for your favorite framework that uses this +module? + + * Express/connect: [csurf](https://www.npmjs.com/package/csurf) or + [alt-xsrf](https://www.npmjs.com/package/alt-xsrf) + * Koa: [koa-csrf](https://www.npmjs.com/package/koa-csrf) or + [koa-atomic-session](https://www.npmjs.com/package/koa-atomic-session) + +### Install + +```bash +$ npm install csrf +``` + +## API + +```js +var Tokens = require('csrf') +``` + +### new Tokens([options]) + +Create a new token generation/verification instance. The `options` argument is +optional and will just use all defaults if missing. + +#### Options + +Tokens accepts these properties in the options object. + +##### saltLength + +The length of the internal salt to use, in characters. Internally, the salt +is a base 62 string. Defaults to `8` characters. + +##### secretLength + +The length of the secret to generate, in bytes. Note that the secret is +passed around base-64 encoded and that this length refers to the underlying +bytes, not the length of the base-64 string. Defaults to `18` bytes. + +#### tokens.create(secret) + +Create a new CSRF token attached to the given `secret`. The `secret` is a +string, typically generated from the `tokens.secret()` or `tokens.secretSync()` +methods. This token is what you should add into HTML `<form>` blocks and +expect the user's browser to provide back. + +```js +var secret = tokens.secretSync() +var token = tokens.create(secret) +``` + +#### tokens.secret(callback) + +Asynchronously create a new `secret`, which is a string. The secret is to +be kept on the server, typically stored in a server-side session for the +user. The secret should be at least per user. + +```js +tokens.secret(function (err, secret) { + if (err) throw err + // do something with the secret +}) +``` + +#### tokens.secret() + +Asynchronously create a new `secret` and return a `Promise`. Please see +`tokens.secret(callback)` documentation for full details. + +**Note**: To use promises in Node.js _prior to 0.12_, promises must be +"polyfilled" using `global.Promise = require('bluebird')`. + +```js +tokens.secret().then(function (secret) { + // do something with the secret +}) +``` + +#### tokens.secretSync() + +A synchronous version of `tokens.secret(callback)`. Please see +`tokens.secret(callback)` documentation for full details. + +```js +var secret = tokens.secretSync() +``` + +#### tokens.verify(secret, token) + +Check whether a CSRF token is valid for the given `secret`, returning +a Boolean. + +```js +if (!tokens.verify(secret, token)) { + throw new Error('invalid token!') +} +``` + +## License + +[MIT](LICENSE) + +[npm-image]: https://img.shields.io/npm/v/csrf.svg +[npm-url]: https://npmjs.org/package/csrf +[node-image]: https://img.shields.io/node/v/csrf.svg +[node-url]: https://nodejs.org/en/download/ +[travis-image]: https://img.shields.io/travis/pillarjs/csrf/master.svg +[travis-url]: https://travis-ci.org/pillarjs/csrf +[coveralls-image]: https://img.shields.io/coveralls/pillarjs/csrf/master.svg +[coveralls-url]: https://coveralls.io/r/pillarjs/csrf?branch=master +[downloads-image]: https://img.shields.io/npm/dm/csrf.svg +[downloads-url]: https://npmjs.org/package/csrf diff --git a/node_modules/csrf/index.js b/node_modules/csrf/index.js new file mode 100644 index 0000000..9b252cd --- /dev/null +++ b/node_modules/csrf/index.js @@ -0,0 +1,139 @@ +/*! + * csrf + * Copyright(c) 2014 Jonathan Ong + * Copyright(c) 2015 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + * @private + */ + +var rndm = require('rndm') +var uid = require('uid-safe') +var compare = require('tsscmp') +var crypto = require('crypto') +var escape = require('base64-url').escape + +/** + * Module exports. + * @public + */ + +module.exports = Tokens + +/** + * Token generation/verification class. + * + * @param {object} [options] + * @param {number} [options.saltLength=8] The string length of the salt + * @param {number} [options.secretLength=18] The byte length of the secret key + * @public + */ + +function Tokens (options) { + if (!(this instanceof Tokens)) { + return new Tokens(options) + } + + var opts = options || {} + + var saltLength = opts.saltLength !== undefined + ? opts.saltLength + : 8 + + if (typeof saltLength !== 'number' || !isFinite(saltLength) || saltLength < 1) { + throw new TypeError('option saltLength must be finite number > 1') + } + + var secretLength = opts.secretLength !== undefined + ? opts.secretLength + : 18 + + if (typeof secretLength !== 'number' || !isFinite(secretLength) || secretLength < 1) { + throw new TypeError('option secretLength must be finite number > 1') + } + + this.saltLength = saltLength + this.secretLength = secretLength +} + +/** + * Create a new CSRF token. + * + * @param {string} secret The secret for the token. + * @public + */ + +Tokens.prototype.create = function create (secret) { + if (!secret || typeof secret !== 'string') { + throw new TypeError('argument secret is required') + } + + return this._tokenize(secret, rndm(this.saltLength)) +} + +/** + * Create a new secret key. + * + * @param {function} [callback] + * @public + */ + +Tokens.prototype.secret = function secret (callback) { + return uid(this.secretLength, callback) +} + +/** + * Create a new secret key synchronously. + * @public + */ + +Tokens.prototype.secretSync = function secretSync () { + return uid.sync(this.secretLength) +} + +/** + * Tokenize a secret and salt. + * @private + */ + +Tokens.prototype._tokenize = function tokenize (secret, salt) { + var hash = crypto + .createHash('sha1') + .update(salt + '-' + secret, 'ascii') + .digest('base64') + return escape(salt + '-' + hash) +} + +/** + * Verify if a given token is valid for a given secret. + * + * @param {string} secret + * @param {string} token + * @public + */ + +Tokens.prototype.verify = function verify (secret, token) { + if (!secret || typeof secret !== 'string') { + return false + } + + if (!token || typeof token !== 'string') { + return false + } + + var index = token.indexOf('-') + + if (index === -1) { + return false + } + + var salt = token.substr(0, index) + var expected = this._tokenize(secret, salt) + + return compare(token, expected) +} diff --git a/node_modules/csrf/node_modules/base64-url/LICENSE b/node_modules/csrf/node_modules/base64-url/LICENSE new file mode 100644 index 0000000..9549143 --- /dev/null +++ b/node_modules/csrf/node_modules/base64-url/LICENSE @@ -0,0 +1,15 @@ +The ISC License + +Copyright (c) 2014, Joaquim José F. Serafim + +Permission to use, copy, modify, and/or distribute this software for any +purpose with or without fee is hereby granted, provided that the above +copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR +IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. diff --git a/node_modules/csrf/node_modules/base64-url/README.md b/node_modules/csrf/node_modules/base64-url/README.md new file mode 100644 index 0000000..d9368c8 --- /dev/null +++ b/node_modules/csrf/node_modules/base64-url/README.md @@ -0,0 +1,55 @@ +# base64-url + +Base64 encode, decode, escape and unescape for URL applications. + +<a href="https://nodei.co/npm/base64-url/"><img src="https://nodei.co/npm/base64-url.png?downloads=true"></a> + +[](https://travis-ci.org/joaquimserafim/base64-url) + + +## API + +```js +base64url.encode('Node.js is awesome.'); +// returns Tm9kZS5qcyBpcyBhd2Vzb21lLg + +base64url.decode('Tm9kZS5qcyBpcyBhd2Vzb21lLg'); +// returns Node.js is awesome. + +base64url.escape('This+is/goingto+escape=='); +// returns This-is_goingto-escape + +base64url.unescape('This-is_goingto-escape'); +// returns This+is/goingto+escape== +``` + + +## Development + +**this projet has been set up with a precommit that forces you to follow a code style, no jshint issues and 100% of code coverage before commit** + + +to run test +``` js +npm test +``` + +to run jshint +``` js +npm run jshint +``` + +to run code style +``` js +npm run code-style +``` + +to check code coverage +``` js +npm run check-coverage +``` + +to open the code coverage report +``` js +npm run coverage +``` diff --git a/node_modules/csrf/node_modules/base64-url/index.js b/node_modules/csrf/node_modules/base64-url/index.js new file mode 100644 index 0000000..34968ae --- /dev/null +++ b/node_modules/csrf/node_modules/base64-url/index.js @@ -0,0 +1,24 @@ +'use strict'; + +var base64url = module.exports; + +base64url.unescape = function unescape (str) { + return (str + Array(5 - str.length % 4) + .join('=')) + .replace(/\-/g, '+') + .replace(/_/g, '/'); +}; + +base64url.escape = function escape (str) { + return str.replace(/\+/g, '-') + .replace(/\//g, '_') + .replace(/=/g, ''); +}; + +base64url.encode = function encode (str) { + return this.escape(new Buffer(str).toString('base64')); +}; + +base64url.decode = function decode (str) { + return new Buffer(this.unescape(str), 'base64').toString(); +}; diff --git a/node_modules/csrf/node_modules/base64-url/package.json b/node_modules/csrf/node_modules/base64-url/package.json new file mode 100644 index 0000000..ab95386 --- /dev/null +++ b/node_modules/csrf/node_modules/base64-url/package.json @@ -0,0 +1,75 @@ +{ + "name": "base64-url", + "version": "1.2.2", + "description": "Base64 encode, decode, escape and unescape for URL applications", + "main": "index.js", + "files": [ + "LICENSE", + "README.md", + "index.js" + ], + "scripts": { + "test": "istanbul cover tape test.js", + "jshint": "jshint -c .jshintrc *.js", + "code-style": "jscs -p google *.js", + "check-coverage": "istanbul check-coverage --statements 100 --functions 100 --lines 100 --branches 100", + "coverage": "open coverage/lcov-report/index.html" + }, + "repository": { + "type": "git", + "url": "git://github.com/joaquimserafim/base64-url.git" + }, + "keywords": [ + "base64", + "base64url" + ], + "author": { + "name": "@joaquimserafim" + }, + "license": "ISC", + "bugs": { + "url": "https://github.com/joaquimserafim/base64-url/issues" + }, + "homepage": "https://github.com/joaquimserafim/base64-url", + "devDependencies": { + "istanbul": "^0.3.5", + "jscs": "^1.9.0", + "jshint": "^2.5.11", + "pre-commit": "0.0.9", + "tape": "^3.0.3", + "which": "^1.0.8" + }, + "pre-commit": [ + "jshint", + "code-style", + "test", + "check-coverage" + ], + "gitHead": "7e5b7e351edbf67ed04e3475663d3a64e0c32035", + "_id": "base64-url@1.2.2", + "_shasum": "90af26ef8b0b67bc801b05eccf943345649008b3", + "_from": "base64-url@1.2.2", + "_npmVersion": "2.15.0", + "_nodeVersion": "4.4.2", + "_npmUser": { + "name": "quim", + "email": "joaquim.serafim@gmail.com" + }, + "dist": { + "shasum": "90af26ef8b0b67bc801b05eccf943345649008b3", + "tarball": "https://registry.npmjs.org/base64-url/-/base64-url-1.2.2.tgz" + }, + "maintainers": [ + { + "name": "quim", + "email": "joaquim.serafim@gmail.com" + } + ], + "_npmOperationalInternal": { + "host": "packages-12-west.internal.npmjs.com", + "tmp": "tmp/base64-url-1.2.2.tgz_1459642531916_0.0884270598180592" + }, + "directories": {}, + "_resolved": "https://registry.npmjs.org/base64-url/-/base64-url-1.2.2.tgz", + "readme": "ERROR: No README data found!" +} diff --git a/node_modules/csrf/node_modules/rndm/LICENSE b/node_modules/csrf/node_modules/rndm/LICENSE new file mode 100644 index 0000000..a7ae8ee --- /dev/null +++ b/node_modules/csrf/node_modules/rndm/LICENSE @@ -0,0 +1,22 @@ + +The MIT License (MIT) + +Copyright (c) 2014 Jonathan Ong me@jongleberry.com + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/node_modules/csrf/node_modules/rndm/README.md b/node_modules/csrf/node_modules/rndm/README.md new file mode 100644 index 0000000..504b1fd --- /dev/null +++ b/node_modules/csrf/node_modules/rndm/README.md @@ -0,0 +1,27 @@ + +# RNDM + +Random string generator. +Basically `Math.random().toString(36).slice(2)`, +but with both upper and lower case letters and arbitrary lengths. +Useful for creating fast, not cryptographically secure salts. + +## API + +```js +// base62 by default +var rndm = require('rndm') +var salt = rndm(16) +``` + +### var salt = rndm(length) + +### var salt = rndm.base62(length) + +### var salt = rndm.base36(length) + +### var salt = rndm.base10(length) + +### var random = rndm.create(characters) + +Create a new random generator with custom characters. diff --git a/node_modules/csrf/node_modules/rndm/index.js b/node_modules/csrf/node_modules/rndm/index.js new file mode 100644 index 0000000..24b0ebb --- /dev/null +++ b/node_modules/csrf/node_modules/rndm/index.js @@ -0,0 +1,25 @@ + +var assert = require('assert') + +var base62 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789' +var base36 = 'abcdefghijklmnopqrstuvwxyz0123456789' +var base10 = '0123456789' + +exports = module.exports = create(base62) +exports.base62 = exports +exports.base36 = create(base36) +exports.base10 = create(base10) + +exports.create = create + +function create(chars) { + assert(typeof chars === 'string', 'the list of characters must be a string!') + var length = Buffer.byteLength(chars) + return function rndm(len) { + len = len || 10 + assert(typeof len === 'number' && len >= 0, 'the length of the random string must be a number!') + var salt = '' + for (var i = 0; i < len; i++) salt += chars[Math.floor(length * Math.random())] + return salt + } +} diff --git a/node_modules/csrf/node_modules/rndm/package.json b/node_modules/csrf/node_modules/rndm/package.json new file mode 100644 index 0000000..191f461 --- /dev/null +++ b/node_modules/csrf/node_modules/rndm/package.json @@ -0,0 +1,73 @@ +{ + "name": "rndm", + "description": "random string generator", + "version": "1.2.0", + "author": { + "name": "Jonathan Ong", + "email": "me@jongleberry.com", + "url": "http://jongleberry.com" + }, + "license": "MIT", + "devDependencies": { + "mocha": "2", + "istanbul": "0" + }, + "repository": { + "type": "git", + "url": "git+https://github.com/crypto-utils/rndm.git" + }, + "scripts": { + "test": "mocha", + "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --reporter dot", + "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --reporter dot" + }, + "keywords": [ + "random", + "number", + "generator", + "uid", + "id" + ], + "files": [ + "index.js" + ], + "gitHead": "9d566c844a4c83487f3b2621be5b6588d5a2b617", + "bugs": { + "url": "https://github.com/crypto-utils/rndm/issues" + }, + "homepage": "https://github.com/crypto-utils/rndm#readme", + "_id": "rndm@1.2.0", + "_shasum": "f33fe9cfb52bbfd520aa18323bc65db110a1b76c", + "_from": "rndm@1.2.0", + "_npmVersion": "2.14.4", + "_nodeVersion": "4.1.1", + "_npmUser": { + "name": "coderhaoxin", + "email": "coderhaoxin@outlook.com" + }, + "maintainers": [ + { + "name": "coderhaoxin", + "email": "coderhaoxin@outlook.com" + }, + { + "name": "dougwilson", + "email": "doug@somethingdoug.com" + }, + { + "name": "fishrock123", + "email": "fishrock123@rocketmail.com" + }, + { + "name": "jongleberry", + "email": "jonathanrichardong@gmail.com" + } + ], + "dist": { + "shasum": "f33fe9cfb52bbfd520aa18323bc65db110a1b76c", + "tarball": "https://registry.npmjs.org/rndm/-/rndm-1.2.0.tgz" + }, + "directories": {}, + "_resolved": "https://registry.npmjs.org/rndm/-/rndm-1.2.0.tgz", + "readme": "ERROR: No README data found!" +} diff --git a/node_modules/csrf/node_modules/tsscmp/.npmignore b/node_modules/csrf/node_modules/tsscmp/.npmignore new file mode 100644 index 0000000..c2658d7 --- /dev/null +++ b/node_modules/csrf/node_modules/tsscmp/.npmignore @@ -0,0 +1 @@ +node_modules/ diff --git a/node_modules/csrf/node_modules/tsscmp/.travis.yml b/node_modules/csrf/node_modules/tsscmp/.travis.yml new file mode 100644 index 0000000..b85d89f --- /dev/null +++ b/node_modules/csrf/node_modules/tsscmp/.travis.yml @@ -0,0 +1,14 @@ +language: node_js +node_js: + - "6" + - "5" + - "5.1" + - "4" + - "4.2" + - "4.1" + - "4.0" + - "0.12" + - "0.11" + - "0.10" + - "0.8" + - "0.6" diff --git a/node_modules/csrf/node_modules/tsscmp/LICENSE b/node_modules/csrf/node_modules/tsscmp/LICENSE new file mode 100644 index 0000000..c62e51b --- /dev/null +++ b/node_modules/csrf/node_modules/tsscmp/LICENSE @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2016 + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. diff --git a/node_modules/csrf/node_modules/tsscmp/README.md b/node_modules/csrf/node_modules/tsscmp/README.md new file mode 100644 index 0000000..cba99d0 --- /dev/null +++ b/node_modules/csrf/node_modules/tsscmp/README.md @@ -0,0 +1,48 @@ +# Timing safe string compare using double HMAC + +[](https://nodejs.org/en/download) +[](https://npmjs.org/package/tsscmp) +[](https://npmjs.org/package/tsscmp) +[](https://travis-ci.org/suryagh/tsscmp) +[](https://ci.appveyor.com/project/suryagh/tsscmp) +[](https://david-dm.org/suryagh/tsscmp) +[](LICENSE) + + +Prevents [timing attacks](http://codahale.com/a-lesson-in-timing-attacks/) using Brad Hill's +[Double HMAC pattern](https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/) +to perform secure string comparison. Double HMAC avoids the timing atacks by blinding the +timing channel using random time per attempt comparison against iterative brute force attacks. + + +## Install + +``` +npm install tsscmp +``` +## Why +To compare secret values like **authentication tokens**, **passwords** or +**capability urls** so that timing information is not +leaked to the attacker. + +## Example + +```js +var timingSafeCompare = require('tsscmp'); + +var sessionToken = '127e6fbfe24a750e72930c'; +var givenToken = '127e6fbfe24a750e72930c'; + +if (timingSafeCompare(sessionToken, givenToken)) { + console.log('good token'); +} else { + console.log('bad token'); +} +``` +##License: +[MIT](LICENSE) + +**Credits to:** [@jsha](https://github.com/jsha) | +[@bnoordhuis](https://github.com/bnoordhuis) | +[@suryagh](https://github.com/suryagh) | +
\ No newline at end of file diff --git a/node_modules/csrf/node_modules/tsscmp/appveyor.yml b/node_modules/csrf/node_modules/tsscmp/appveyor.yml new file mode 100644 index 0000000..29cd460 --- /dev/null +++ b/node_modules/csrf/node_modules/tsscmp/appveyor.yml @@ -0,0 +1,29 @@ +# Test against this version of Node.js +environment: + matrix: + # nodejs_version: "0.6" not supported in Windows x86 + - nodejs_version: "0.8" + - nodejs_version: "0.10" + - nodejs_version: "0.11" + - nodejs_version: "0.12" + - nodejs_version: "4.0" + - nodejs_version: "5.0" + - nodejs_version: "6.0" + +# Install scripts. (runs after repo cloning) +install: + # Get the latest stable version of Node.js or io.js + - ps: Install-Product node $env:nodejs_version + # install modules + - npm install + +# Post-install test scripts. +test_script: + # Output useful info for debugging. + - node --version + - npm --version + # run tests + - npm test + +# Don't actually build. +build: off diff --git a/node_modules/csrf/node_modules/tsscmp/lib/index.js b/node_modules/csrf/node_modules/tsscmp/lib/index.js new file mode 100644 index 0000000..7c86142 --- /dev/null +++ b/node_modules/csrf/node_modules/tsscmp/lib/index.js @@ -0,0 +1,33 @@ +'use strict'; + +// Implements Brad Hill's Double HMAC pattern from +// https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/february/double-hmac-verification/. +// The approach is similar to the node's native implementation of timing safe buffer comparison that will be available on v6+. +// https://github.com/nodejs/node/issues/3043 +// https://github.com/nodejs/node/pull/3073 + +var crypto = require('crypto'); + +function bufferEqual(a, b) { + if (a.length !== b.length) { + return false; + } + for (var i = 0; i < a.length; i++) { + if (a[i] !== b[i]) { + return false; + } + } + return true; +} + +function timeSafeCompare(a, b) { + var sa = String(a); + var sb = String(b); + var key = crypto.pseudoRandomBytes(32); + var ah = crypto.createHmac('sha256', key).update(sa).digest(); + var bh = crypto.createHmac('sha256', key).update(sb).digest(); + + return bufferEqual(ah, bh) && a === b; +} + +module.exports = timeSafeCompare; diff --git a/node_modules/csrf/node_modules/tsscmp/package.json b/node_modules/csrf/node_modules/tsscmp/package.json new file mode 100644 index 0000000..6c6be76 --- /dev/null +++ b/node_modules/csrf/node_modules/tsscmp/package.json @@ -0,0 +1,62 @@ +{ + "name": "tsscmp", + "version": "1.0.5", + "description": "Timing safe string compare using double HMAC", + "main": "lib/index.js", + "dependencies": {}, + "devDependencies": {}, + "scripts": { + "test": "node test/unit && node test/benchmark" + }, + "repository": { + "type": "git", + "url": "git+https://github.com/suryagh/tsscmp.git" + }, + "keywords": [ + "timing safe string compare", + "double hmac string compare", + "safe string compare", + "hmac" + ], + "author": { + "name": "suryagh" + }, + "publishConfig": { + "registry": "https://registry.npmjs.org" + }, + "engines": { + "node": ">=0.6.x" + }, + "license": "MIT", + "gitHead": "095fb02b3e6102cbd1d2bdc9613e3da54e782f59", + "bugs": { + "url": "https://github.com/suryagh/tsscmp/issues" + }, + "homepage": "https://github.com/suryagh/tsscmp#readme", + "_id": "tsscmp@1.0.5", + "_shasum": "7dc4a33af71581ab4337da91d85ca5427ebd9a97", + "_from": "tsscmp@1.0.5", + "_npmVersion": "3.6.0", + "_nodeVersion": "5.6.0", + "_npmUser": { + "name": "suryagh", + "email": "surya.com@gmail.com" + }, + "dist": { + "shasum": "7dc4a33af71581ab4337da91d85ca5427ebd9a97", + "tarball": "https://registry.npmjs.org/tsscmp/-/tsscmp-1.0.5.tgz" + }, + "maintainers": [ + { + "name": "suryagh", + "email": "surya.com@gmail.com" + } + ], + "_npmOperationalInternal": { + "host": "packages-16-east.internal.npmjs.com", + "tmp": "tmp/tsscmp-1.0.5.tgz_1464226502956_0.48576042777858675" + }, + "directories": {}, + "_resolved": "https://registry.npmjs.org/tsscmp/-/tsscmp-1.0.5.tgz", + "readme": "ERROR: No README data found!" +} diff --git a/node_modules/csrf/node_modules/tsscmp/test/benchmark/index.js b/node_modules/csrf/node_modules/tsscmp/test/benchmark/index.js new file mode 100644 index 0000000..fd93e42 --- /dev/null +++ b/node_modules/csrf/node_modules/tsscmp/test/benchmark/index.js @@ -0,0 +1,30 @@ +'use strict'; + +var timeSafeCompare = require('../../lib/index'); + +function random(length) { + + length = length || 32; + var result = ""; + var possible = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-+/*[]{}-=\|;\':\"<>?,./"; + + for( var i=0; i < length; i++ ){ + result += possible.charAt(Math.floor(Math.random() * possible.length)); + } + return result; +} + +function run(count) { + count = count || 100*1000; + console.log('benchmark count: ' + count/1000 + 'k'); + console.time('benchmark'); + + while(count--){ + timeSafeCompare(random(), random()); + } + console.timeEnd('benchmark'); +} + +run(100000); + +module.exports = run; diff --git a/node_modules/csrf/node_modules/tsscmp/test/unit/index.js b/node_modules/csrf/node_modules/tsscmp/test/unit/index.js new file mode 100644 index 0000000..0335423 --- /dev/null +++ b/node_modules/csrf/node_modules/tsscmp/test/unit/index.js @@ -0,0 +1,69 @@ +'use strict'; + +var assert = require('assert'); +var timeSafeCompare = require('../../lib/index'); + +process.on('error', function (e) { + console.log('caught: ' + e); +}); + +function testEqual(a, b) { + assert(timeSafeCompare(a, b)); + + // lets also do a parity check with the strict equal to operator + assert(a === b); +} + +function testNotEqual(a, b) { + assert(!timeSafeCompare(a, b)); + + // lets also do a parity check with the strict not equal to operator + assert(a !== b); +} + +// note: lets also make sure tsscmp can be inline replaced for any types - +// just incase if anyone is interested + +// positive tests +testEqual('127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935', + '127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935', + 'test '); +testEqual('a', 'a'); +testEqual('', ''); +testEqual(undefined, undefined); +testEqual(true, true); +testEqual(false, false); +(function () { + var a = { a: 1 }; + testEqual(a, a); +})(); +(function () { + function f1() { return 1; }; + testEqual(f1, f1); +})(); + +// negative tests +testNotEqual(''); +testNotEqual('a', 'b'); +testNotEqual('a', 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'); +testNotEqual('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', 'a'); +testNotEqual('alpha', 'beta'); +testNotEqual(false, true); +testNotEqual(false, undefined); +testNotEqual(function () { }, function () { }); +testNotEqual({}, {}); +testNotEqual({ a: 1 }, { a: 1 }); +testNotEqual({ a: 1 }, { a: 2 }); +testNotEqual([1, 2], [1, 2]); +testNotEqual([1, 2], [1, 2, 3]); +(function () { + var a = { p: 1 }; + var b = { p: 1 }; + testNotEqual(a, b); +})(); +(function () { + function f1() { return 1; }; + function f2() { return 1; }; + testNotEqual(f1, f2); +})(); +console.log('Success: all tests complete.'); diff --git a/node_modules/csrf/node_modules/uid-safe/HISTORY.md b/node_modules/csrf/node_modules/uid-safe/HISTORY.md new file mode 100644 index 0000000..365c92f --- /dev/null +++ b/node_modules/csrf/node_modules/uid-safe/HISTORY.md @@ -0,0 +1,41 @@ +2.1.1 / 2016-05-04 +================== + + * deps: base64-url@1.2.2 + +2.1.0 / 2016-01-17 +================== + + * Use `random-bytes` for byte source + +2.0.0 / 2015-05-08 +================== + + * Use global `Promise` when returning a promise + +1.1.0 / 2015-02-01 +================== + + * Use `crypto.randomBytes`, if available + * deps: base64-url@1.2.1 + +1.0.3 / 2015-01-31 +================== + + * Fix error branch that would throw + * deps: base64-url@1.2.0 + +1.0.2 / 2015-01-08 +================== + + * Remove dependency on `mz` + +1.0.1 / 2014-06-18 +================== + + * Remove direct `bluebird` dependency + +1.0.0 / 2014-06-18 +================== + + * Initial release diff --git a/node_modules/csrf/node_modules/uid-safe/LICENSE b/node_modules/csrf/node_modules/uid-safe/LICENSE new file mode 100644 index 0000000..7a7a4e1 --- /dev/null +++ b/node_modules/csrf/node_modules/uid-safe/LICENSE @@ -0,0 +1,22 @@ +The MIT License (MIT) + +Copyright (c) 2014 Jonathan Ong <me@jongleberry.com> +Copyright (c) 2015-2016 Douglas Christopher Wilson <doug@somethingdoug.com> + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/node_modules/csrf/node_modules/uid-safe/README.md b/node_modules/csrf/node_modules/uid-safe/README.md new file mode 100644 index 0000000..fa02be8 --- /dev/null +++ b/node_modules/csrf/node_modules/uid-safe/README.md @@ -0,0 +1,77 @@ +# uid-safe + +[![NPM Version][npm-image]][npm-url] +[![NPM Downloads][downloads-image]][downloads-url] +[![Node.js Version][node-version-image]][node-version-url] +[![Build Status][travis-image]][travis-url] +[![Test Coverage][coveralls-image]][coveralls-url] + +URL and cookie safe UIDs + +Create cryptographically secure UIDs safe for both cookie and URL usage. +This is in contrast to modules such as [rand-token](https://www.npmjs.com/package/rand-token) +and [uid2](https://www.npmjs.com/package/uid2) whose UIDs are actually skewed +due to the use of `%` and unnecessarily truncate the UID. +Use this if you could still use UIDs with `-` and `_` in them. + +## Installation + +```sh +$ npm install uid-safe +``` + +## API + +```js +var uid = require('uid-safe') +``` + +### uid(byteLength, callback) + +Asynchronously create a UID with a specific byte length. Because `base64` +encoding is used underneath, this is not the string length. For example, +to create a UID of length 24, you want a byte length of 18. + +```js +uid(18, function (err, string) { + if (err) throw err + // do something with the string +}) +``` + +### uid(byteLength) + +Asynchronously create a UID with a specific byte length and return a +`Promise`. + +**Note**: To use promises in Node.js _prior to 0.12_, promises must be +"polyfilled" using `global.Promise = require('bluebird')`. + +```js +uid(18).then(function (string) { + // do something with the string +}) +``` + +### uid.sync(byteLength) + +A synchronous version of above. + +```js +var string = uid.sync(18) +``` + +## License + +[MIT](LICENSE) + +[npm-image]: https://img.shields.io/npm/v/uid-safe.svg +[npm-url]: https://npmjs.org/package/uid-safe +[node-version-image]: https://img.shields.io/node/v/uid-safe.svg +[node-version-url]: https://nodejs.org/en/download/ +[travis-image]: https://img.shields.io/travis/crypto-utils/uid-safe/master.svg +[travis-url]: https://travis-ci.org/crypto-utils/uid-safe +[coveralls-image]: https://img.shields.io/coveralls/crypto-utils/uid-safe/master.svg +[coveralls-url]: https://coveralls.io/r/crypto-utils/uid-safe?branch=master +[downloads-image]: https://img.shields.io/npm/dm/uid-safe.svg +[downloads-url]: https://npmjs.org/package/uid-safe diff --git a/node_modules/csrf/node_modules/uid-safe/index.js b/node_modules/csrf/node_modules/uid-safe/index.js new file mode 100644 index 0000000..9bef704 --- /dev/null +++ b/node_modules/csrf/node_modules/uid-safe/index.js @@ -0,0 +1,96 @@ +/*! + * uid-safe + * Copyright(c) 2014 Jonathan Ong + * Copyright(c) 2015-2016 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + * @private + */ + +var escape = require('base64-url').escape +var randomBytes = require('random-bytes') + +/** + * Module exports. + * @public + */ + +module.exports = uid +module.exports.sync = uidSync + +/** + * Create a unique ID. + * + * @param {number} length + * @param {function} [callback] + * @return {Promise} + * @public + */ + +function uid(length, callback) { + // validate callback is a function, if provided + if (callback !== undefined && typeof callback !== 'function') { + throw new TypeError('argument callback must be a function') + } + + // require the callback without promises + if (!callback && !global.Promise) { + throw new TypeError('argument callback is required') + } + + if (callback) { + // classic callback style + return generateUid(length, callback) + } + + return new Promise(function executor(resolve, reject) { + generateUid(length, function onUid(err, str) { + if (err) return reject(err) + resolve(str) + }) + }) +} + +/** + * Create a unique ID sync. + * + * @param {number} length + * @return {string} + * @public + */ + +function uidSync(length) { + return toString(randomBytes.sync(length)) +} + +/** + * Generate a unique ID string. + * + * @param {number} length + * @param {function} callback + * @private + */ + +function generateUid(length, callback) { + randomBytes(length, function (err, buf) { + if (err) return callback(err) + callback(null, toString(buf)) + }) +} + +/** + * Change a Buffer into a string. + * + * @param {Buffer} buf + * @return {string} + * @private + */ + +function toString(buf) { + return escape(buf.toString('base64')) +} diff --git a/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/HISTORY.md b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/HISTORY.md new file mode 100644 index 0000000..8cabd9d --- /dev/null +++ b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/HISTORY.md @@ -0,0 +1,4 @@ +1.0.0 / 2016-01-17 +================== + + * Initial release diff --git a/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/LICENSE b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/LICENSE new file mode 100644 index 0000000..c24dbe3 --- /dev/null +++ b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/LICENSE @@ -0,0 +1,21 @@ +The MIT License (MIT) + +Copyright (c) 2016 Douglas Christopher Wilson <doug@somethingdoug.com> + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN +THE SOFTWARE. diff --git a/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/README.md b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/README.md new file mode 100644 index 0000000..df5aacc --- /dev/null +++ b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/README.md @@ -0,0 +1,77 @@ +# random-bytes + +[![NPM Version][npm-image]][npm-url] +[![NPM Downloads][downloads-image]][downloads-url] +[![Node.js Version][node-version-image]][node-version-url] +[![Build Status][travis-image]][travis-url] +[![Test Coverage][coveralls-image]][coveralls-url] + +Generate strong pseudo-random bytes. + +This module is a simple wrapper around the Node.js core `crypto.randomBytes` API, +with the following additions: + + * A `Promise` interface for environments with promises. + * For Node.js versions that do not wait for the PRNG to be seeded, this module + will wait a bit. + +## Installation + +```sh +$ npm install random-bytes +``` + +## API + +```js +var randomBytes = require('random-bytes') +``` + +### randomBytes(size, callback) + +Generates strong pseudo-random bytes. The `size` argument is a number indicating +the number of bytes to generate. + +```js +randomBytes(12, function (error, bytes) { + if (error) throw error + // do something with the bytes +}) +``` + +### randomBytes(size) + +Generates strong pseudo-random bytes and return a `Promise`. The `size` argument is +a number indicating the number of bytes to generate. + +**Note**: To use promises in Node.js _prior to 0.12_, promises must be +"polyfilled" using `global.Promise = require('bluebird')`. + +```js +randomBytes(18).then(function (string) { + // do something with the string +}) +``` + +### randomBytes.sync(size) + +A synchronous version of above. + +```js +var bytes = randomBytes.sync(18) +``` + +## License + +[MIT](LICENSE) + +[npm-image]: https://img.shields.io/npm/v/random-bytes.svg +[npm-url]: https://npmjs.org/package/random-bytes +[node-version-image]: https://img.shields.io/node/v/random-bytes.svg +[node-version-url]: http://nodejs.org/download/ +[travis-image]: https://img.shields.io/travis/crypto-utils/random-bytes/master.svg +[travis-url]: https://travis-ci.org/crypto-utils/random-bytes +[coveralls-image]: https://img.shields.io/coveralls/crypto-utils/random-bytes/master.svg +[coveralls-url]: https://coveralls.io/r/crypto-utils/random-bytes?branch=master +[downloads-image]: https://img.shields.io/npm/dm/random-bytes.svg +[downloads-url]: https://npmjs.org/package/random-bytes diff --git a/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/index.js b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/index.js new file mode 100644 index 0000000..9ad930f --- /dev/null +++ b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/index.js @@ -0,0 +1,101 @@ +/*! + * random-bytes + * Copyright(c) 2016 Douglas Christopher Wilson + * MIT Licensed + */ + +'use strict' + +/** + * Module dependencies. + * @private + */ + +var crypto = require('crypto') + +/** + * Module variables. + * @private + */ + +var generateAttempts = crypto.randomBytes === crypto.pseudoRandomBytes ? 1 : 3 + +/** + * Module exports. + * @public + */ + +module.exports = randomBytes +module.exports.sync = randomBytesSync + +/** + * Generates strong pseudo-random bytes. + * + * @param {number} size + * @param {function} [callback] + * @return {Promise} + * @public + */ + +function randomBytes(size, callback) { + // validate callback is a function, if provided + if (callback !== undefined && typeof callback !== 'function') { + throw new TypeError('argument callback must be a function') + } + + // require the callback without promises + if (!callback && !global.Promise) { + throw new TypeError('argument callback is required') + } + + if (callback) { + // classic callback style + return generateRandomBytes(size, generateAttempts, callback) + } + + return new Promise(function executor(resolve, reject) { + generateRandomBytes(size, generateAttempts, function onRandomBytes(err, str) { + if (err) return reject(err) + resolve(str) + }) + }) +} + +/** + * Generates strong pseudo-random bytes sync. + * + * @param {number} size + * @return {Buffer} + * @public + */ + +function randomBytesSync(size) { + var err = null + + for (var i = 0; i < generateAttempts; i++) { + try { + return crypto.randomBytes(size) + } catch (e) { + err = e + } + } + + throw err +} + +/** + * Generates strong pseudo-random bytes. + * + * @param {number} size + * @param {number} attempts + * @param {function} callback + * @private + */ + +function generateRandomBytes(size, attempts, callback) { + crypto.randomBytes(size, function onRandomBytes(err, buf) { + if (!err) return callback(null, buf) + if (!--attempts) return callback(err) + setTimeout(generateRandomBytes.bind(null, size, attempts, callback), 10) + }) +} diff --git a/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/package.json b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/package.json new file mode 100644 index 0000000..8f56cba --- /dev/null +++ b/node_modules/csrf/node_modules/uid-safe/node_modules/random-bytes/package.json @@ -0,0 +1,68 @@ +{ + "name": "random-bytes", + "description": "URL and cookie safe UIDs", + "version": "1.0.0", + "contributors": [ + { + "name": "Douglas Christopher Wilson", + "email": "doug@somethingdoug.com" + } + ], + "license": "MIT", + "repository": { + "type": "git", + "url": "git+https://github.com/crypto-utils/random-bytes.git" + }, + "devDependencies": { + "bluebird": "3.1.1", + "istanbul": "0.4.2", + "mocha": "2.3.4", + "proxyquire": "1.2.0" + }, + "files": [ + "LICENSE", + "HISTORY.md", + "README.md", + "index.js" + ], + "engines": { + "node": ">= 0.8" + }, + "scripts": { + "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/", + "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/", + "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/" + }, + "keywords": [ + "bytes", + "generator", + "random", + "safe" + ], + "gitHead": "3dcd47425a3dfe858ee8debcd4db0c1222110bc3", + "bugs": { + "url": "https://github.com/crypto-utils/random-bytes/issues" + }, + "homepage": "https://github.com/crypto-utils/random-bytes", + "_id": "random-bytes@1.0.0", + "_shasum": "4f68a1dc0ae58bd3fb95848c30324db75d64360b", + "_from": "random-bytes@>=1.0.0 <1.1.0", + "_npmVersion": "1.4.28", + "_npmUser": { + "name": "dougwilson", + "email": "doug@somethingdoug.com" + }, + "maintainers": [ + { + "name": "dougwilson", + "email": "doug@somethingdoug.com" + } + ], + "dist": { + "shasum": "4f68a1dc0ae58bd3fb95848c30324db75d64360b", + "tarball": "https://registry.npmjs.org/random-bytes/-/random-bytes-1.0.0.tgz" + }, + "directories": {}, + "_resolved": "https://registry.npmjs.org/random-bytes/-/random-bytes-1.0.0.tgz", + "readme": "ERROR: No README data found!" +} diff --git a/node_modules/csrf/node_modules/uid-safe/package.json b/node_modules/csrf/node_modules/uid-safe/package.json new file mode 100644 index 0000000..295b4a9 --- /dev/null +++ b/node_modules/csrf/node_modules/uid-safe/package.json @@ -0,0 +1,89 @@ +{ + "name": "uid-safe", + "description": "URL and cookie safe UIDs", + "version": "2.1.1", + "contributors": [ + { + "name": "Douglas Christopher Wilson", + "email": "doug@somethingdoug.com" + }, + { + "name": "Jonathan Ong", + "email": "me@jongleberry.com", + "url": "http://jongleberry.com" + } + ], + "license": "MIT", + "repository": { + "type": "git", + "url": "git+https://github.com/crypto-utils/uid-safe.git" + }, + "dependencies": { + "base64-url": "1.2.2", + "random-bytes": "~1.0.0" + }, + "devDependencies": { + "bluebird": "3.3.5", + "istanbul": "0.4.3", + "mocha": "2.4.5" + }, + "files": [ + "LICENSE", + "HISTORY.md", + "README.md", + "index.js" + ], + "engines": { + "node": ">= 0.8" + }, + "scripts": { + "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/", + "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/", + "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/" + }, + "keywords": [ + "random", + "generator", + "uid", + "safe" + ], + "gitHead": "5cb17ae9451505ac823877e641a6f080731822ea", + "bugs": { + "url": "https://github.com/crypto-utils/uid-safe/issues" + }, + "homepage": "https://github.com/crypto-utils/uid-safe#readme", + "_id": "uid-safe@2.1.1", + "_shasum": "3dbf9436b528be9f52882c05a6216c3763db3666", + "_from": "uid-safe@2.1.1", + "_npmVersion": "2.15.1", + "_nodeVersion": "4.4.3", + "_npmUser": { + "name": "dougwilson", + "email": "doug@somethingdoug.com" + }, + "dist": { + "shasum": "3dbf9436b528be9f52882c05a6216c3763db3666", + "tarball": "https://registry.npmjs.org/uid-safe/-/uid-safe-2.1.1.tgz" + }, + "maintainers": [ + { + "name": "dougwilson", + "email": "doug@somethingdoug.com" + }, + { + "name": "fishrock123", + "email": "fishrock123@rocketmail.com" + }, + { + "name": "jongleberry", + "email": "jonathanrichardong@gmail.com" + } + ], + "_npmOperationalInternal": { + "host": "packages-12-west.internal.npmjs.com", + "tmp": "tmp/uid-safe-2.1.1.tgz_1462417218771_0.08699076832272112" + }, + "directories": {}, + "_resolved": "https://registry.npmjs.org/uid-safe/-/uid-safe-2.1.1.tgz", + "readme": "ERROR: No README data found!" +} diff --git a/node_modules/csrf/package.json b/node_modules/csrf/package.json new file mode 100644 index 0000000..ff25f57 --- /dev/null +++ b/node_modules/csrf/package.json @@ -0,0 +1,93 @@ +{ + "name": "csrf", + "description": "primary logic behind csrf tokens", + "version": "3.0.3", + "author": { + "name": "Jonathan Ong", + "email": "me@jongleberry.com", + "url": "http://jongleberry.com" + }, + "contributors": [ + { + "name": "Douglas Christopher Wilson", + "email": "doug@somethingdoug.com" + } + ], + "license": "MIT", + "repository": { + "type": "git", + "url": "git+https://github.com/pillarjs/csrf.git" + }, + "dependencies": { + "base64-url": "1.2.2", + "rndm": "1.2.0", + "tsscmp": "1.0.5", + "uid-safe": "2.1.1" + }, + "devDependencies": { + "bluebird": "3.4.0", + "eslint": "2.10.2", + "eslint-config-standard": "5.3.1", + "eslint-plugin-promise": "1.3.0", + "eslint-plugin-standard": "1.3.2", + "istanbul": "0.4.3", + "mocha": "2.5.3" + }, + "files": [ + "LICENSE", + "HISTORY.md", + "README.md", + "index.js" + ], + "engines": { + "node": ">= 0.8" + }, + "scripts": { + "lint": "eslint **/*.js", + "test": "mocha --trace-deprecation --reporter spec --bail --check-leaks test/", + "test-cov": "istanbul cover node_modules/mocha/bin/_mocha -- --trace-deprecation --reporter dot --check-leaks test/", + "test-travis": "istanbul cover node_modules/mocha/bin/_mocha --report lcovonly -- --trace-deprecation --reporter spec --check-leaks test/" + }, + "keywords": [ + "csrf", + "tokens" + ], + "gitHead": "dbf7629bbff7ae14dfa7fab1b439e01b5ba3b629", + "bugs": { + "url": "https://github.com/pillarjs/csrf/issues" + }, + "homepage": "https://github.com/pillarjs/csrf", + "_id": "csrf@3.0.3", + "_shasum": "69d13220de95762808bb120f7533a994fc4293b5", + "_from": "csrf@latest", + "_npmVersion": "1.4.28", + "_npmUser": { + "name": "dougwilson", + "email": "doug@somethingdoug.com" + }, + "maintainers": [ + { + "name": "dougwilson", + "email": "doug@somethingdoug.com" + }, + { + "name": "dwolla", + "email": "api@dwolla.com" + }, + { + "name": "jongleberry", + "email": "jonathanrichardong@gmail.com" + } + ], + "dist": { + "shasum": "69d13220de95762808bb120f7533a994fc4293b5", + "tarball": "https://registry.npmjs.org/csrf/-/csrf-3.0.3.tgz" + }, + "_npmOperationalInternal": { + "host": "packages-12-west.internal.npmjs.com", + "tmp": "tmp/csrf-3.0.3.tgz_1464315403837_0.44625049154274166" + }, + "directories": {}, + "_resolved": "https://registry.npmjs.org/csrf/-/csrf-3.0.3.tgz", + "readme": "ERROR: No README data found!" +} |