cbor-x 1.5.7 → 1.5.9

package/dist/node.cjs

@@ -501,7 +501,12 @@ function createStructureReader(structure) {
 }
 
 function safeKey(key) {
-	return key === '__proto__' ? '__proto_' : key
+	// protect against prototype pollution
+	if (typeof key === 'string') return key === '__proto__' ? '__proto_' : key
+	if (typeof key === 'number' || typeof key === 'boolean' || typeof key === 'bigint') return key.toString();
+	if (key == null) return key + '';
+	// protect against expensive (DoS) string conversions
+	throw new Error('Invalid property name type ' + typeof key);
 }
 
 let readFixedString = readStringJS;
@@ -919,6 +924,7 @@ currentExtensions[28] = (read) => {
 		referenceMap.id = 0;
 	}
 	let id = referenceMap.id++;
+	let startingPosition = position$1;
 	let token = src[position$1];
 	let target;
 	// TODO: handle Maps, Sets, and other types that can cycle; this is complicated, because you potentially need to read
@@ -931,8 +937,20 @@ currentExtensions[28] = (read) => {
 	let refEntry = { target }; // a placeholder object
 	referenceMap.set(id, refEntry);
 	let targetProperties = read(); // read the next value as the target object to id
-	if (refEntry.used) // there is a cycle, so we have to assign properties to original target
+	if (refEntry.used) {// there is a cycle, so we have to assign properties to original target
+		if (Object.getPrototypeOf(target) !== Object.getPrototypeOf(targetProperties)) {
+			// this means that the returned target does not match the targetProperties, so we need rerun the read to
+			// have the correctly create instance be assigned as a reference, then we do the copy the properties back to the
+			// target
+			// reset the position so that the read can be repeated
+			position$1 = startingPosition;
+			// the returned instance is our new target for references
+			target = targetProperties;
+			referenceMap.set(id, { target });
+			targetProperties = read();
+		}
 		return Object.assign(target, targetProperties)
+	}
 	refEntry.target = targetProperties; // the placeholder wasn't used, replace with the deserialized one
 	return targetProperties // no cycle, can just use the returned read object
 };
@@ -1014,7 +1032,7 @@ function registerTypedArray(TypedArray, tag) {
 	for (let littleEndian = 0; littleEndian < 2; littleEndian++) {
 		if (!littleEndian && bytesPerElement == 1)
 			continue
-		let sizeShift = bytesPerElement == 2 ? 1 : bytesPerElement == 4 ? 2 : 3;
+		let sizeShift = bytesPerElement == 2 ? 1 : bytesPerElement == 4 ? 2 : bytesPerElement == 8 ? 3 : 0;
 		currentExtensions[littleEndian ? tag : (tag - 4)] = (bytesPerElement == 1 || littleEndian == isLittleEndianMachine$1) ? (buffer) => {
 			if (!TypedArray)
 				throw new Error('Could not find typed array for code ' + tag)
@@ -1024,7 +1042,7 @@ function registerTypedArray(TypedArray, tag) {
 					bytesPerElement === 2 && !(buffer.byteOffset & 1) ||
 					bytesPerElement === 4 && !(buffer.byteOffset & 3) ||
 					bytesPerElement === 8 && !(buffer.byteOffset & 7))
-					return new TypedArray(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+					return new TypedArray(buffer.buffer, buffer.byteOffset, buffer.byteLength >> sizeShift);
 			}
 			// we have to slice/copy here to get a new ArrayBuffer, if we are not word/byte aligned
 			return new TypedArray(Uint8Array.prototype.slice.call(buffer, 0).buffer)
@@ -1628,7 +1646,7 @@ class Encoder extends Decoder {
 					}
 					let constructor = value.constructor;
 					if (constructor === Object) {
-						writeObject(value, true);
+						writeObject(value);
 					} else if (constructor === Array) {
 						length = value.length;
 						if (length < 0x18) {
@@ -1723,8 +1741,8 @@ class Encoder extends Decoder {
 								return encode(json)
 						}
 
-						// no extension found, write as object
-						writeObject(value, !value.hasOwnProperty); // if it doesn't have hasOwnProperty, don't do hasOwnProperty checks
+						// no extension found, write as a plain object
+						writeObject(value);
 					}
 				}
 			} else if (type === 'boolean') {
@@ -1786,19 +1804,19 @@ class Encoder extends Decoder {
 				}
 			}
 		} :
-		(object, safePrototype) => {
+		(object) => {
 			target[position++] = 0xb9; // always use map 16, so we can preallocate and set the length afterwards
 			let objectOffset = position - start;
 			position += 2;
 			let size = 0;
 			if (encoder.keyMap) { 
-				for (let key in object) if (safePrototype || object.hasOwnProperty(key)) {
+				for (let key in object) if (typeof object.hasOwnProperty !== 'function' || object.hasOwnProperty(key)) {
 					encode(encoder.encodeKey(key));
 					encode(object[key]);
 					size++;
 				}
 			} else { 
-				for (let key in object) if (safePrototype || object.hasOwnProperty(key)) {
+				for (let key in object) if (typeof object.hasOwnProperty !== 'function' || object.hasOwnProperty(key)) {
 						encode(key);
 						encode(object[key]);
 					size++;
@@ -1807,7 +1825,7 @@ class Encoder extends Decoder {
 			target[objectOffset++ + start] = size >> 8;
 			target[objectOffset + start] = size & 0xff;
 		} :
-		(object, safePrototype) => {
+		(object, skipValues) => {
 			let nextTransition, transition = structures.transitions || (structures.transitions = Object.create(null));
 			let newTransitions = 0;
 			let length = 0;
@@ -1826,7 +1844,7 @@ class Encoder extends Decoder {
 					transition = nextTransition;
 				}				
 			} else {
-				for (let key in object) if (safePrototype || object.hasOwnProperty(key)) {
+				for (let key in object) if (typeof object.hasOwnProperty !== 'function' || object.hasOwnProperty(key)) {
 					nextTransition = transition[key];
 					if (!nextTransition) {
 						if (transition[RECORD_SYMBOL] & 0x100000) {// this indicates it is a brancheable/extendable terminal node, so we will use this record id and extend it
@@ -1886,9 +1904,9 @@ class Encoder extends Decoder {
 					writeArrayHeader(length + 2);
 					encode(0xe000 + recordId);
 					encode(keys);
-					if (safePrototype === null) return; // special exit for iterator
+					if (skipValues) return; // special exit for iterator
 					for (let key in object)
-						if (safePrototype || object.hasOwnProperty(key))
+						if (typeof object.hasOwnProperty !== 'function' || object.hasOwnProperty(key))
 							encode(object[key]);
 					return
 				}
@@ -1898,9 +1916,9 @@ class Encoder extends Decoder {
 			} else {
 				writeArrayHeader(length);
 			}
-			if (safePrototype === null) return; // special exit for iterator
+			if (skipValues) return; // special exit for iterator
 			for (let key in object)
-				if (safePrototype || object.hasOwnProperty(key))
+				if (typeof object.hasOwnProperty !== 'function' || object.hasOwnProperty(key))
 					encode(object[key]);
 		};
 		const makeRoom = (end) => {
@@ -1938,7 +1956,7 @@ class Encoder extends Decoder {
 			if (constructor === Object) {
 				let useRecords = encoder.useRecords !== false;
 				if (useRecords)
-					writeObject(object, null); // write the record identifier
+					writeObject(object, true); // write the record identifier
 				else
 					writeEntityLength(Object.keys(object).length, 0xa0);
 				for (let key in object) {