@rsvelte/vite-plugin-svelte-native 0.1.3 → 0.1.4

package/envelope.js

@@ -25,6 +25,27 @@ const WARN_HAS_START = 1 << 1;
 const WARN_HAS_END = 1 << 2;
 const WARN_HAS_FRAME = 1 << 3;
 
+/**
+ * Validate that the byte window `[off, off + len)` lies fully inside a
+ * buffer of `bufLen` bytes. The encoder writes offsets/lengths as u32s
+ * the decoder otherwise trusts blindly — `buf.toString` / `subarray`
+ * silently *clamp* an out-of-range window, so a malformed envelope would
+ * decode to truncated data instead of failing loudly. Throw instead (M-012).
+ *
+ * @param {number} bufLen
+ * @param {number} off
+ * @param {number} len
+ * @param {string} label
+ */
+function assertWindow(bufLen, off, len, label) {
+	if (off < 0 || len < 0 || off + len > bufLen) {
+		throw new Error(
+			`[rsvelte] envelope ${label} out of bounds ` +
+				`(offset ${off} + length ${len} exceeds buffer of ${bufLen} bytes)`,
+		);
+	}
+}
+
 /**
  * Decode an envelope produced by `compileEnvelope` / `compileModuleEnvelope`.
  *
@@ -71,10 +92,24 @@ function decodeEnvelope(buf) {
 	const cssMapLen = view.getUint32(44, true);
 	const warningsOff = view.getUint32(48, true);
 	const warningsCount = view.getUint32(52, true);
+	const warningsLen = view.getUint32(56, true);
 
 	const hasCss = (flags & FLAG_HAS_CSS) !== 0;
 	const runes = (flags & FLAG_RUNES) !== 0;
 
+	// Validate every field window up front so a malformed envelope throws
+	// at decode time rather than silently truncating on first lazy read.
+	// A zero offset marks an absent optional field (the header alone fills
+	// the first HEADER_LEN bytes, so real data never starts at offset 0).
+	const len = buf.byteLength;
+	assertWindow(len, jsCodeOff, jsCodeLen, 'js.code');
+	if (jsMapOff !== 0) assertWindow(len, jsMapOff, jsMapLen, 'js.map');
+	if (hasCss) {
+		assertWindow(len, cssCodeOff, cssCodeLen, 'css.code');
+		if (cssMapOff !== 0) assertWindow(len, cssMapOff, cssMapLen, 'css.map');
+	}
+	if (warningsCount > 0) assertWindow(len, warningsOff, warningsLen, 'warnings');
+
 	// `buf.toString('utf8', start, end)` is the V8 fast path for
 	// Buffer→string and is consistently faster than wrapping in a
 	// TextDecoder; fall back to TextDecoder for plain Uint8Array.
@@ -109,7 +144,7 @@ function decodeEnvelope(buf) {
 		configurable: true,
 		get() {
 			if (warningsCache === null) {
-				warningsCache = decodeWarnings(buf, view, warningsOff, warningsCount, slice);
+				warningsCache = decodeWarnings(buf, view, warningsOff, warningsLen, warningsCount, slice);
 			}
 			return warningsCache;
 		},
@@ -186,29 +221,50 @@ function makeCodeMapObject(buf, slice, codeOff, codeLen, mapOff, mapLen) {
 	return obj;
 }
 
-function decodeWarnings(buf, view, off, count, slice) {
+function decodeWarnings(buf, view, off, regionLen, count, slice) {
+	// Every record field is bounds-checked against the warnings region
+	// (already validated to lie inside the buffer by the caller) so a
+	// corrupt internal length throws rather than reading adjacent bytes
+	// or overrunning the buffer.
+	const end = off + regionLen;
+	const need = (p, n, what) => {
+		if (p < off || p + n > end) {
+			throw new Error(
+				`[rsvelte] truncated warning ${what} at offset ${p} ` +
+					`(needs ${n} bytes, region ends at ${end})`,
+			);
+		}
+	};
 	const out = new Array(count);
 	let p = off;
 	for (let i = 0; i < count; i++) {
+		need(p, 4, 'code length');
 		const codeLen = view.getUint32(p, true);
 		p += 4;
+		need(p, codeLen, 'code');
 		const code = slice(p, codeLen);
 		p += codeLen;
+		need(p, 4, 'message length');
 		const msgLen = view.getUint32(p, true);
 		p += 4;
+		need(p, msgLen, 'message');
 		const message = slice(p, msgLen);
 		p += msgLen;
+		need(p, 1, 'flags');
 		const flags = view.getUint8(p);
 		p += 1;
 
 		const w = { code, message };
 		if (flags & WARN_HAS_FILENAME) {
+			need(p, 4, 'filename length');
 			const len = view.getUint32(p, true);
 			p += 4;
+			need(p, len, 'filename');
 			w.filename = slice(p, len);
 			p += len;
 		}
 		if (flags & WARN_HAS_START) {
+			need(p, 12, 'start position');
 			w.start = {
 				line: view.getUint32(p, true),
 				column: view.getUint32(p + 4, true),
@@ -217,6 +273,7 @@ function decodeWarnings(buf, view, off, count, slice) {
 			p += 12;
 		}
 		if (flags & WARN_HAS_END) {
+			need(p, 12, 'end position');
 			w.end = {
 				line: view.getUint32(p, true),
 				column: view.getUint32(p + 4, true),
@@ -228,8 +285,10 @@ function decodeWarnings(buf, view, off, count, slice) {
 			w.position = [w.start.character, w.end.character];
 		}
 		if (flags & WARN_HAS_FRAME) {
+			need(p, 4, 'frame length');
 			const len = view.getUint32(p, true);
 			p += 4;
+			need(p, len, 'frame');
 			w.frame = slice(p, len);
 			p += len;
 		}
@@ -298,12 +357,22 @@ function decodeBatch(buf) {
 	}
 	const count = view.getUint32(12, true);
 
+	// The entry table must fit inside the buffer before we index into it.
+	const tableEnd = BATCH_HEADER_LEN + count * BATCH_ENTRY_LEN;
+	if (tableEnd > buf.byteLength) {
+		throw new Error(
+			`[rsvelte] batch entry table (${count} entries) exceeds buffer ` +
+				`(needs ${tableEnd} bytes, buffer is ${buf.byteLength})`,
+		);
+	}
+
 	const out = new Array(count);
 	for (let i = 0; i < count; i++) {
 		const entryOff = BATCH_HEADER_LEN + i * BATCH_ENTRY_LEN;
 		const status = view.getUint32(entryOff, true);
 		const payloadOff = view.getUint32(entryOff + 4, true);
 		const payloadLen = view.getUint32(entryOff + 8, true);
+		assertWindow(buf.byteLength, payloadOff, payloadLen, `batch entry ${i}`);
 		// Subarray gives a zero-copy view into the same underlying
 		// ArrayBuffer; `decodeEnvelope` walks it without further allocation.
 		const slice = buf.subarray

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rsvelte/vite-plugin-svelte-native",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "NAPI bindings to the rsvelte compiler — used by the @rsvelte vite-plugin-svelte shim",
   "license": "MIT",
   "repository": {
@@ -27,11 +27,11 @@
     "index.d.ts"
   ],
   "optionalDependencies": {
-    "@rsvelte/vite-plugin-svelte-native-darwin-arm64": "^0.1.3",
-    "@rsvelte/vite-plugin-svelte-native-darwin-x64": "^0.1.3",
-    "@rsvelte/vite-plugin-svelte-native-linux-arm64-gnu": "^0.1.3",
-    "@rsvelte/vite-plugin-svelte-native-linux-x64-gnu": "^0.1.3",
-    "@rsvelte/vite-plugin-svelte-native-win32-x64-msvc": "^0.1.3"
+    "@rsvelte/vite-plugin-svelte-native-darwin-arm64": "^0.1.4",
+    "@rsvelte/vite-plugin-svelte-native-darwin-x64": "^0.1.4",
+    "@rsvelte/vite-plugin-svelte-native-linux-arm64-gnu": "^0.1.4",
+    "@rsvelte/vite-plugin-svelte-native-linux-x64-gnu": "^0.1.4",
+    "@rsvelte/vite-plugin-svelte-native-win32-x64-msvc": "^0.1.4"
   },
   "publishConfig": {
     "access": "public"