cbor-x 1.5.7 → 1.5.9

package/dist/index-no-eval.cjs

@@ -498,7 +498,12 @@
 	}
 
 	function safeKey(key) {
-		return key === '__proto__' ? '__proto_' : key
+		// protect against prototype pollution
+		if (typeof key === 'string') return key === '__proto__' ? '__proto_' : key
+		if (typeof key === 'number' || typeof key === 'boolean' || typeof key === 'bigint') return key.toString();
+		if (key == null) return key + '';
+		// protect against expensive (DoS) string conversions
+		throw new Error('Invalid property name type ' + typeof key);
 	}
 
 	let readFixedString = readStringJS;
@@ -881,6 +886,7 @@
 			referenceMap.id = 0;
 		}
 		let id = referenceMap.id++;
+		let startingPosition = position$1;
 		let token = src[position$1];
 		let target;
 		// TODO: handle Maps, Sets, and other types that can cycle; this is complicated, because you potentially need to read
@@ -893,8 +899,20 @@
 		let refEntry = { target }; // a placeholder object
 		referenceMap.set(id, refEntry);
 		let targetProperties = read(); // read the next value as the target object to id
-		if (refEntry.used) // there is a cycle, so we have to assign properties to original target
+		if (refEntry.used) {// there is a cycle, so we have to assign properties to original target
+			if (Object.getPrototypeOf(target) !== Object.getPrototypeOf(targetProperties)) {
+				// this means that the returned target does not match the targetProperties, so we need rerun the read to
+				// have the correctly create instance be assigned as a reference, then we do the copy the properties back to the
+				// target
+				// reset the position so that the read can be repeated
+				position$1 = startingPosition;
+				// the returned instance is our new target for references
+				target = targetProperties;
+				referenceMap.set(id, { target });
+				targetProperties = read();
+			}
 			return Object.assign(target, targetProperties)
+		}
 		refEntry.target = targetProperties; // the placeholder wasn't used, replace with the deserialized one
 		return targetProperties // no cycle, can just use the returned read object
 	};
@@ -976,7 +994,7 @@
 		for (let littleEndian = 0; littleEndian < 2; littleEndian++) {
 			if (!littleEndian && bytesPerElement == 1)
 				continue
-			let sizeShift = bytesPerElement == 2 ? 1 : bytesPerElement == 4 ? 2 : 3;
+			let sizeShift = bytesPerElement == 2 ? 1 : bytesPerElement == 4 ? 2 : bytesPerElement == 8 ? 3 : 0;
 			currentExtensions[littleEndian ? tag : (tag - 4)] = (bytesPerElement == 1 || littleEndian == isLittleEndianMachine$1) ? (buffer) => {
 				if (!TypedArray)
 					throw new Error('Could not find typed array for code ' + tag)
@@ -986,7 +1004,7 @@
 						bytesPerElement === 2 && !(buffer.byteOffset & 1) ||
 						bytesPerElement === 4 && !(buffer.byteOffset & 3) ||
 						bytesPerElement === 8 && !(buffer.byteOffset & 7))
-						return new TypedArray(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+						return new TypedArray(buffer.buffer, buffer.byteOffset, buffer.byteLength >> sizeShift);
 				}
 				// we have to slice/copy here to get a new ArrayBuffer, if we are not word/byte aligned
 				return new TypedArray(Uint8Array.prototype.slice.call(buffer, 0).buffer)
@@ -1586,7 +1604,7 @@
 						}
 						let constructor = value.constructor;
 						if (constructor === Object) {
-							writeObject(value, true);
+							writeObject(value);
 						} else if (constructor === Array) {
 							length = value.length;
 							if (length < 0x18) {
@@ -1681,8 +1699,8 @@
 									return encode(json)
 							}
 
-							// no extension found, write as object
-							writeObject(value, !value.hasOwnProperty); // if it doesn't have hasOwnProperty, don't do hasOwnProperty checks
+							// no extension found, write as a plain object
+							writeObject(value);
 						}
 					}
 				} else if (type === 'boolean') {
@@ -1744,19 +1762,19 @@
 					}
 				}
 			} :
-			(object, safePrototype) => {
+			(object) => {
 				target[position++] = 0xb9; // always use map 16, so we can preallocate and set the length afterwards
 				let objectOffset = position - start;
 				position += 2;
 				let size = 0;
 				if (encoder.keyMap) { 
-					for (let key in object) if (safePrototype || object.hasOwnProperty(key)) {
+					for (let key in object) if (typeof object.hasOwnProperty !== 'function' || object.hasOwnProperty(key)) {
 						encode(encoder.encodeKey(key));
 						encode(object[key]);
 						size++;
 					}
 				} else { 
-					for (let key in object) if (safePrototype || object.hasOwnProperty(key)) {
+					for (let key in object) if (typeof object.hasOwnProperty !== 'function' || object.hasOwnProperty(key)) {
 							encode(key);
 							encode(object[key]);
 						size++;
@@ -1765,7 +1783,7 @@
 				target[objectOffset++ + start] = size >> 8;
 				target[objectOffset + start] = size & 0xff;
 			} :
-			(object, safePrototype) => {
+			(object, skipValues) => {
 				let nextTransition, transition = structures.transitions || (structures.transitions = Object.create(null));
 				let newTransitions = 0;
 				let length = 0;
@@ -1784,7 +1802,7 @@
 						transition = nextTransition;
 					}				
 				} else {
-					for (let key in object) if (safePrototype || object.hasOwnProperty(key)) {
+					for (let key in object) if (typeof object.hasOwnProperty !== 'function' || object.hasOwnProperty(key)) {
 						nextTransition = transition[key];
 						if (!nextTransition) {
 							if (transition[RECORD_SYMBOL] & 0x100000) {// this indicates it is a brancheable/extendable terminal node, so we will use this record id and extend it
@@ -1844,9 +1862,9 @@
 						writeArrayHeader(length + 2);
 						encode(0xe000 + recordId);
 						encode(keys);
-						if (safePrototype === null) return; // special exit for iterator
+						if (skipValues) return; // special exit for iterator
 						for (let key in object)
-							if (safePrototype || object.hasOwnProperty(key))
+							if (typeof object.hasOwnProperty !== 'function' || object.hasOwnProperty(key))
 								encode(object[key]);
 						return
 					}
@@ -1856,9 +1874,9 @@
 				} else {
 					writeArrayHeader(length);
 				}
-				if (safePrototype === null) return; // special exit for iterator
+				if (skipValues) return; // special exit for iterator
 				for (let key in object)
-					if (safePrototype || object.hasOwnProperty(key))
+					if (typeof object.hasOwnProperty !== 'function' || object.hasOwnProperty(key))
 						encode(object[key]);
 			};
 			const makeRoom = (end) => {
@@ -1896,7 +1914,7 @@
 				if (constructor === Object) {
 					let useRecords = encoder.useRecords !== false;
 					if (useRecords)
-						writeObject(object, null); // write the record identifier
+						writeObject(object, true); // write the record identifier
 					else
 						writeEntityLength(Object.keys(object).length, 0xa0);
 					for (let key in object) {