invoice-canister
invoice-canister copied to clipboard
[SEC-F12] Copied libraries
Observation
The sha256, crc32 and hex libraries are copied into the repository.
Risk Description
If the libraries are copied, it is hard to keep them up to date. Also it is not clear if and how they are tested and where they come from.
Recommendations
Use these libraries as a dependency rather than copying them.
Aviate lab's package set would be sufficient for doing this? Specifically:
https://github.com/aviate-labs/crypto.mo https://github.com/aviate-labs/io.mo https://github.com/aviate-labs/hash.mo https://github.com/aviate-labs/encoding.mo https://github.com/aviate-labs/principal.mo
Contain many of the functions that could be used to refactor and simplify the necessary operations. Unless there's an official Dfinity package set somewhere?
Using the aviate labs libraries is good with me