Merge pull request #3 from louisbuchbinder/vanillajs

remove large or negative number vulnerability

.gitignore

@@ -1,2 +1,3 @@
 .DS_Store
-node_modules
+node_modules
+npm-debug.log

src/base58.js

@@ -8,9 +8,9 @@ var alphabetLookup = alphabet.split('').reduce(function (lookup, char, index) {
 	return lookup;
 }, {});
 
-function assertInteger(val) {
+function assertNonNegativeSafeInteger(val) {
-	if (typeof val !== 'number' || isNaN(val) || Math.floor(val) !== val) {
+	if (typeof val !== 'number' || isNaN(val) || val < 0 || val > Number.MAX_SAFE_INTEGER || Math.floor(val) !== val) {
-		throw new Error('Value passed is not an integer.');
+		throw new Error('Value passed is not a non-negative safe integer.');
 	}
 }
 
@@ -33,7 +33,7 @@ exports.encode = function (num) {
 
 	num = Number(num);
 
-	assertInteger(num);
+	assertNonNegativeSafeInteger(num);
 
 	while (num >= base) {
 		modulus = num % base;

test/base58.test.js

@@ -49,7 +49,7 @@ describe('Base58', function () {
 				assert.throws(function () {
 					base58.encode('hi');
 				}, function (err) {
-					return err.message === 'Value passed is not an integer.';
+					return err.message === 'Value passed is not a non-negative safe integer.';
 				});
 			});
 		});
@@ -59,7 +59,27 @@ describe('Base58', function () {
 				assert.throws(function () {
 					base58.encode(3.14);
 				}, function (err) {
-					return err.message === 'Value passed is not an integer.';
+					return err.message === 'Value passed is not a non-negative safe integer.';
+				});
+			});
+		});
+
+		describe('when passed a negative number', function () {
+			it('throws an error', function () {
+				assert.throws(function () {
+					base58.encode(-300);
+				}, function (err) {
+					return err.message === 'Value passed is not a non-negative safe integer.';
+				});
+			});
+		});
+
+		describe('when passed a non-safe integer', function () {
+			it('throws an error', function () {
+				assert.throws(function () {
+					base58.encode(1E100);
+				}, function (err) {
+					return err.message === 'Value passed is not a non-negative safe integer.';
 				});
 			});
 		});