Skip to content

Conversation

@leeland-turnkey
Copy link
Contributor

@leeland-turnkey leeland-turnkey commented Dec 10, 2025

Using export function fromDerSignature from @turnkey/crypto to standardize this function between repos. They are both supposed to have the same functionality anyways. Since this function specifically looks for short form, we don't need to support long form length:

https://github.com/tkhq/sdk/blob/3406928772254aeb4f47259e43d8618a677dd0a2/packages/crypto/src/crypto.ts#L671-L672

…not checked to be 0x30,

No checks for canonical (minimal) representation of DER-encoded numbers,
Bounds for array slicings are not checked
@socket-security
Copy link

socket-security bot commented Dec 12, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​turnkey/​crypto@​2.8.61001008395100

View full report

@leeland-turnkey leeland-turnkey changed the title Weak validations in fromDerSignature Use fromDerSignature function from @turnkey/crypto Dec 12, 2025
"@noble/ed25519": "2.0.0",
"@noble/hashes": "1.3.2",
"@solana/web3.js": "1.98.4",
"@turnkey/crypto": "^2.8.6",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tiny nit: let's hard-pin this dependency just to keep things consistent/locked down

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done. Is this a normal approach here at Turnkey?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It sorta depends. In security-critical packages or here in frames, we would prefer to, just to be really on top of the dependencies we're using. Otherwise, in less-security-critical places like example apps, it's not as critical

@leeland-turnkey leeland-turnkey merged commit a02932b into main Dec 15, 2025
9 checks passed
@leeland-turnkey leeland-turnkey deleted the leeland/eng-2788-tob-55-the-fromdersignature-function-in-export-and-sign branch December 15, 2025 19:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants