@node-red/util 5.0.7 → 5.0.8

package/lib/util.js

@@ -470,6 +470,10 @@ function setObjectProperty(msg,prop,value,createMissing) {
     var obj = msg;
     var key;
     for (var i=0;i<length-1;i++) {
+        if (obj === null || (typeof obj !== "object" && typeof obj !== "function")) {
+            // Cannot traverse a property beneath a non-object/array
+            return false;
+        }
         key = msgPropParts[i];
         if (typeof key === 'string' || (typeof key === 'number' && !Array.isArray(obj))) {
             if (Object.hasOwn(obj, key)) {
@@ -507,6 +511,10 @@ function setObjectProperty(msg,prop,value,createMissing) {
             }
         }
     }
+    if (obj === null || (typeof obj !== "object" && typeof obj !== "function")) {
+        // Cannot set or delete a property beneath a non-object/array
+        return false;
+    }
     key = msgPropParts[length-1];
     if (typeof value === "undefined") {
         if (typeof key === 'number' && Array.isArray(obj)) {
@@ -858,6 +866,56 @@ function normaliseNodeTypeName(name) {
     return result;
 }
 
+/**
+ * Full length of a Buffer whose toJSON data was truncated by
+ * stringifyWithTruncatedBuffers
+ */
+const truncatedBufferLength = Symbol("truncatedBufferLength");
+
+/**
+ * Stringify an object like safeJSONStringify, but only convert the first
+ * `maxLength` bytes of any Buffer that is longer than that.
+ *
+ * JSON.stringify calls Buffer's toJSON, which copies every byte into an
+ * array, before the replacer gets to see the value. For large Buffers that
+ * can take a long time or exhaust the heap, so a truncating toJSON is used
+ * for the duration of the call.
+ * @param  {Object} obj - the object to stringify
+ * @param  {Number} maxLength - the number of bytes to keep of each Buffer
+ * @param  {Function} replacer - the replacer for safeJSONStringify
+ * @return {String} the JSON string
+ */
+function stringifyWithTruncatedBuffers(obj, maxLength, replacer) {
+    if (!(maxLength >= 0)) {
+        return safeJSONStringify(obj, replacer);
+    }
+    const bufferToJSON = Buffer.prototype.toJSON;
+    const truncatingToJSON = function() {
+        if (this.length <= maxLength) {
+            return bufferToJSON.call(this);
+        }
+        const value = {
+            type: "Buffer",
+            data: Array.from(this.subarray(0,maxLength))
+        };
+        value[truncatedBufferLength] = this.length;
+        return value;
+    };
+    Buffer.prototype.toJSON = truncatingToJSON;
+    // The finally block is skipped if execution is terminated while
+    // stringifying, e.g. by the timeout of a Function node calling node.warn
+    process.nextTick(function() {
+        if (Buffer.prototype.toJSON === truncatingToJSON) {
+            Buffer.prototype.toJSON = bufferToJSON;
+        }
+    });
+    try {
+        return safeJSONStringify(obj, replacer);
+    } finally {
+        Buffer.prototype.toJSON = bufferToJSON;
+    }
+}
+
 /**
  * Encode an object to JSON without losing information about non-JSON types
  * such as Buffer and Function.
@@ -903,7 +961,8 @@ function encodeObject(msg,opts) {
             msg.msg = JSON.stringify(value);
         } else if (msg.msg instanceof Buffer) {
             msg.format = "buffer["+msg.msg.length+"]";
-            msg.msg = msg.msg.toString('hex');
+            // Only hex encode the bytes that will be shown
+            msg.msg = msg.msg.toString('hex', 0, debuglength >= 0 ? Math.ceil(debuglength/2) : undefined);
             if (msg.msg.length > debuglength) {
                 msg.msg = msg.msg.substring(0,debuglength);
             }
@@ -962,7 +1021,7 @@ function encodeObject(msg,opts) {
                     msg.msg = msg.msg.toString();
                 }
                 if (needsStringify || (msg.format === "Object")) {
-                    msg.msg = safeJSONStringify(msg.msg, function(key, value) {
+                    msg.msg = stringifyWithTruncatedBuffers(msg.msg, debuglength, function(key, value) {
                         if (key === '_req' || key === '_res') {
                             value = {
                                 __enc__: true,
@@ -1034,7 +1093,7 @@ function encodeObject(msg,opts) {
                         } else if (value && value.constructor) {
                             if (value.type === "Buffer") {
                                 value.__enc__ = true;
-                                value.length = value.data.length;
+                                value.length = value[truncatedBufferLength] ?? value.data.length;
                                 if (value.length > debuglength) {
                                     value.data = value.data.slice(0,debuglength);
                                 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@node-red/util",
-    "version": "5.0.7",
+    "version": "5.0.8",
     "license": "Apache-2.0",
     "repository": {
         "type": "git",
@@ -16,11 +16,11 @@
     ],
     "dependencies": {
         "chalk": "^4.1.2",
-        "fs-extra": "11.4.0",
+        "fs-extra": "11.4.1",
         "i18next": "25.8.14",
         "json-stringify-safe": "5.0.1",
         "lodash.clonedeep": "^4.5.0",
-        "moment": "2.30.1",
+        "moment": "2.31.0",
         "moment-timezone": "0.5.48"
     }
 }