Skip to content
Merged
Show file tree
Hide file tree
Changes from 7 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@
}
},
"dependencies": {
"@noble/curves": "^1.8.1",
"@scure/base": "^1.2.4",
Comment thread
carlosmiei marked this conversation as resolved.
Outdated
"https-proxy-agent": "^7.0.0",
"json-bigint": "^1.0.0",
"lodash.zipobject": "^4.1.3",
Expand Down
49 changes: 46 additions & 3 deletions src/node-binance-api.ts
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@

import WebSocket from 'ws';
// import request from 'request';
import crypto from 'crypto';
import crypto, { createSign } from 'crypto';
import file from 'fs';
import url from 'url';
import JSONbig from 'json-bigint';
Expand All @@ -11,6 +11,11 @@ import { HttpsProxyAgent } from 'https-proxy-agent';
import { SocksProxyAgent } from 'socks-proxy-agent';
// @ts-ignore
import nodeFetch from 'node-fetch';
// @ts-ignore
import { ed25519 } from '@noble/curves/ed25519';
// @ts-ignore
import { base64 } from '@scure/base';

// @ts-ignore
import zip from 'lodash.zipobject';
import stringHash from 'string-hash';
Expand Down Expand Up @@ -503,7 +508,7 @@ export default class Binance {
data.timestamp += this.timeOffset;
}
query = this.makeQueryString(data);
data.signature = crypto.createHmac('sha256', this.APISECRET).update(query).digest('hex'); // HMAC hash header
data.signature = this.generateSignature(query);
opt.url = `${url}?${query}&signature=${data.signature}`;
}
(opt as any).qs = data;
Expand Down Expand Up @@ -615,7 +620,9 @@ export default class Binance {

if (!data.recvWindow) data.recvWindow = this.Options.recvWindow;
const query = method === 'POST' && noDataInSignature ? '' : this.makeQueryString(data);
const signature = crypto.createHmac('sha256', this.Options.APISECRET).update(query).digest('hex'); // set the HMAC hash header

const signature = this.generateSignature(query);

if (method === 'POST') {
const opt = this.reqObjPOST(
url,
Expand All @@ -638,6 +645,42 @@ export default class Binance {
}
}

unarmorKey(a:string):number[] {
// eslint-disable-next-line no-useless-escape
const m = /-----BEGIN [^-]+-----\n([A-Za-z0-9+\/=\s]+)\n-----END [^-]+-----|begin-base64[^\n]+\n([A-Za-z0-9+\/=\s]+)====/.exec(a);
if (m) {
if (m[1]) {
a = m[1];
} else if (m[2]) {
a = m[2];
} else {
throw new Error("RegExp out of sync");
}
}
return base64.decode(a);
}
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we shouldn't use this method at all, why do we need it? it is confusing (which might scare some users), does an exec, ... all red flags

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

btw most crypto libs already properly parse the private key headers

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

about this, I've just copy-pasted that unarmor function from ccxt:
https://github.com/ccxt/ccxt/blob/master/ts/src/base/functions/crypto.ts#L110 (the source is also in ccxt: https://github.com/ccxt/ccxt/blob/master/ts/src/static_dependencies/jsencrypt/lib/asn1js/base64.ts#L74 ), i didn't even look in details of it

as it's bad, we should also remove from ccxt

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ttodua if you check the latest implementation in this branch it does not use any of that


generateSignature(query: string) {
const APISECRET = this.Options.APISECRET || this.APISECRET;
Comment thread
carlosmiei marked this conversation as resolved.
Outdated
let signature = '';
if (APISECRET.includes ('PRIVATE KEY')) {
// if less than the below length, then it can't be RSA key
if (APISECRET.length < 500) {
Comment thread
carlosmiei marked this conversation as resolved.
Outdated
const privateKey = new Uint8Array (this.unarmorKey (APISECRET).slice (16));
const encodedQuery = new TextEncoder().encode(query);
const signatureInit = ed25519.sign (encodedQuery, privateKey);
signature = base64.encode (signatureInit);
} else {
const signed = createSign('RSA-SHA256').update(query);
signature = signed.sign(APISECRET, 'base64');
signature = encodeURIComponent (signature);
}
} else {
signature = crypto.createHmac('sha256', this.Options.APISECRET).update(query).digest('hex'); // set the HMAC hash header
Comment thread
carlosmiei marked this conversation as resolved.
}
return signature;
}

// --- ENDPOINTS --- //

/**
Expand Down