bitpay/bitcore — pull request #452 by matiu (2014-07-24 20:48:11+00:00)
Title: TransactionBuilder .fromObj .toObj rewrite

This is a rewrite of .fromObj .toObj and .merge functions at `TransactionBuilder`.

This considers that objects received in .merge could have been modified maliciously. The main modification is:
- .toObj does not store ANY derived field, with the sole exception of the signatures (scriptSig), in case there are present. Instead, it stores the inputs for the class (with the exception of the private keys).
- .fromObj recreated the class from the stored inputs.
- the new .clone method, clones the class using from .toObj .fromObj roundtrip.

-.merge strictly check in the input class that the parameters were the same, and in the signatures, that the opts.signhash is respected.

This is related to the security bug reported, but does not intent to solve it directly, but to prevent new similar issues.

Previously existing TransactionBuilder tests where used to check this implementation. Extra test where made to check edge cases in the new strategy.