ChainSafe / ChainSafe/lodestar

Remove usage of Number constructor

Open
#3,779 4 comments 0 reactions 0 assignees View on GitHub
good first issue help wanted prio-medium scope-security
Dominant language
TypeScript
Stars
1.4k
Forks
483
Avg merge
1d 16h
Merged PRs (30d)
150

Description

The Number constructor is very unsafe because:
- It takes `any` as parameter. If we change from passing a string to Number to some object Typescript will compile and we'll get `NaN`.

If you do a text search of the `Number` constructor there are many occurrences:
- If Number arg is already an argument, remove
- If Number arg is a string, use `parseInt()`
- If Number arg is a bigint, use a custom util that types like `bigintToNumber(bn: bigint): number`

If the input of any of those functions is un-trusted data, verify the return is not NaN

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.