ChainSafe / ChainSafe/lodestar
Remove usage of Number constructor
Open
good first issue
help wanted
prio-medium
scope-security
- Dominant language
- TypeScript
- Stars
- 1.4k
- Forks
- 483
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 150
Description
The Number constructor is very unsafe because:
- It takes `any` as parameter. If we change from passing a string to Number to some object Typescript will compile and we'll get `NaN`.
If you do a text search of the `Number` constructor there are many occurrences:
- If Number arg is already an argument, remove
- If Number arg is a string, use `parseInt()`
- If Number arg is a bigint, use a custom util that types like `bigintToNumber(bn: bigint): number`
If the input of any of those functions is un-trusted data, verify the return is not NaN
Contributor guide
Assessment
This issue has not been assessed yet.