cbor-x 1.6.0 → 1.6.4

package/README.md

@@ -29,7 +29,7 @@ This `encode` function will generate standard CBOR without any extensions that s
 Cbor-x modules are standard ESM modules and can be loaded directly from the [deno.land registry for cbor](https://deno.land/x/cbor) for use in Deno. The standard encode and decode functionality is available on Deno, like other platforms.
 
 ### Streams
-We can use the including streaming functionality (which further improves performance). The `EncoderStream` is a NodeJS transform stream that can be used to serialize objects to a binary stream (writing to network/socket, IPC, etc.), and the `DecoderStream` can be used to deserialize objects from a binary sream (reading from network/socket, etc.):
+We can use the including streaming functionality (which further improves performance). The `EncoderStream` is a NodeJS transform stream that can be used to serialize objects to a binary stream (writing to network/socket, IPC, etc.), and the `DecoderStream` can be used to deserialize objects from a binary stream (reading from network/socket, etc.):
 
 ```JavaScript
 import { EncoderStream } from 'cbor-x';
@@ -89,23 +89,22 @@ import { decode } from 'cbor-x/decode' // if you only need to decode
 ```
 
 ## Structured Cloning
-You can also use cbor-x for [structured cloning](https://html.spec.whatwg.org/multipage/structured-data.html). By enabling the `structuredClone` option, you can include references to other objects or cyclic references, and object identity will be preserved. Structured cloning also enables preserving certain typed objects like `Error`, `Set`, `RegExp` and TypedArray instances, using [registered CBOR tag extensions](https://www.iana.org/assignments/cbor-tags/cbor-tags.xhtml). For example:
+You can also use cbor-x for [structured cloning](https://html.spec.whatwg.org/multipage/structured-data.html). By enabling the `structuredClone` option, you can include references to other objects or cyclic references, and object identity will be preserved.For example:
 ```JavaScript
 let obj = {
-	set: new Set(['a', 'b']),
-	regular: /a\spattern/
 };
 obj.self = obj;
 let encoder = new Encoder({ structuredClone: true });
 let serialized = encoder.encode(obj);
 let copy = encoder.decode(serialized);
 copy.self === copy // true
-copy.set.has('a') // true
 
 ```
 
 This option is disabled by default because reference checking degrades performance (by about 25-30%). (Note this implementation doesn't serialize every class/type specified in the HTML specification since not all of them make sense for storing across platforms.)
 
+cbor-x also preserves certain typed objects like `Error`, `Set`, `RegExp` and TypedArray instances, using [registered CBOR tag extensions](https://www.iana.org/assignments/cbor-tags/cbor-tags.xhtml). This works with or without structured cloning enabled.
+
 ## Record / Object Structures
 There is a critical difference between maps (or dictionaries) that hold an arbitrary set of keys and values (JavaScript `Map` is designed for these), and records or object structures that have a well-defined set of fields. Typical JS objects/records may have many instances re(use) the same structure. By using the record extension, this distinction is preserved in CBOR and the encoding can reuse structures and not only provides better type preservation, but yield much more compact encodings and increase decoding performance by 2-3x. Cbor-x automatically generates record definitions that are reused and referenced by objects with the same structure. Records use CBOR's tags to align well CBOR's tag/extension mechanism. There are a number of ways to use this to our advantage. For large object structures with repeating nested objects with similar structures, simply serializing with the record extension can yield significant benefits. To use the record structures extension, we create a new `Encoder` instance. By default a new `Encoder` instance will have the record extension enabled:
 ```JavaScript
@@ -166,7 +165,7 @@ The principle driver for this feature is to support `application/senml+cbor`cont
 Records are also supported in conjunction with keyMaps, but these are disabled by default when keyMaps are specified as use of the two features does not introduce any additional compression efficiency unless that the data arrays are quite large (> 10 items).
 
 ```JavaScript
-import { Encoder } from 'cbor-x'
+import { Decoder, Encoder } from 'cbor-x'
 const data = [ 
 	{ bn: '/3303/0/5700', bt: 1278887, v: 35.5 },
 	{ t: 10, v: 34 },
@@ -183,7 +182,8 @@ let senmlBuff = senmlCbor.encode(data)
 let basicBuff = basicCbor.encode(data)
 console.log('Senml CBOR size:', senmlBuff.length) // 77
 console.log('Basic CBOR size:', basicBuff.length) // 90
-assert.deepEqual(senmlEncoder.decode(senmlBuff), data)
+let senmlDecoder = new Decoder({ keyMap: senmlKeys }); 
+assert.deepEqual(senmlDecoder.decode(senmlBuff), data)
 
 ```
 
@@ -213,6 +213,7 @@ The following options properties can be provided to the Encoder or Decoder const
 * `useTag259ForMaps` - This flag indicates if [tag 259 (explicit maps)](https://github.com/shanewholloway/js-cbor-codec/blob/master/docs/CBOR-259-spec--explicit-maps.md) should be used to encode JS `Map`s. When using records is enabled, this is disabled by default, since plain objects are encoded with record structures and unambigiously differentiated from `Map`s, which are encoded as CBOR maps. Without using records, this enabled by default and is necessary to distinguish plain objects from `Map`s (but can be disabled by setting this to `false`).
 * `tagUint8Array` - Indicates if tag 64 should be used for `Uint8Array`s. 
 * `int64AsNumber` - This will decode uint64 and int64 numbers as standard JS numbers rather than as bigint numbers.
+* `skipFunction`  - This skip functions in encode object.
 
 ### 32-bit Float Options
 By default all non-integer numbers are serialized as 64-bit float (double). This is fast, and ensures maximum precision. However, often real-world data doesn't not need 64-bits of precision, and using 32-bit encoding can be much more space efficient. There are several options that provide more efficient encodings. Using the decimal rounding options for encoding and decoding provides lossless storage of common decimal representations like 7.99, in more efficient 32-bit format (rather than 64-bit). The `useFloat32` property has several possible options, available from the module as constants:

package/decode.js

@@ -273,6 +273,7 @@ export function read() {
 				}
 				token = dataView.getUint32(position)
 				position += 4
+				if (majorType === 1) return -1 - token; // can't safely use negation operator here
 				break
 			case 0x1b:
 				if (majorType == 7) {
@@ -287,8 +288,7 @@ export function read() {
 				} else if (currentDecoder.int64AsNumber) {
 					token = dataView.getUint32(position) * 0x100000000
 					token += dataView.getUint32(position + 4)
-				} else
-					token = dataView.getBigUint64(position)
+				} else token = dataView.getBigUint64(position)
 				position += 8
 				break
 			case 0x1f: 
@@ -611,26 +611,45 @@ function readStringJS(length) {
 		} else if ((byte1 & 0xe0) === 0xc0) {
 			// 2 bytes
 			const byte2 = src[position++] & 0x3f
-			units.push(((byte1 & 0x1f) << 6) | byte2)
+			const codePoint = ((byte1 & 0x1f) << 6) | byte2
+			// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
+			if (codePoint < 0x80) {
+				units.push(0xFFFD) // replacement character
+			} else {
+				units.push(codePoint)
+			}
 		} else if ((byte1 & 0xf0) === 0xe0) {
 			// 3 bytes
 			const byte2 = src[position++] & 0x3f
 			const byte3 = src[position++] & 0x3f
-			units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3)
+			const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3
+			// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
+			// Also reject surrogates (0xD800-0xDFFF)
+			if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
+				units.push(0xFFFD) // replacement character
+			} else {
+				units.push(codePoint)
+			}
 		} else if ((byte1 & 0xf8) === 0xf0) {
 			// 4 bytes
 			const byte2 = src[position++] & 0x3f
 			const byte3 = src[position++] & 0x3f
 			const byte4 = src[position++] & 0x3f
 			let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4
-			if (unit > 0xffff) {
+			// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
+			// Also reject values > 0x10FFFF (maximum valid Unicode)
+			if (unit < 0x10000 || unit > 0x10FFFF) {
+				units.push(0xFFFD) // replacement character
+			} else if (unit > 0xffff) {
 				unit -= 0x10000
 				units.push(((unit >>> 10) & 0x3ff) | 0xd800)
 				unit = 0xdc00 | (unit & 0x3ff)
+				units.push(unit)
+			} else {
+				units.push(unit)
 			}
-			units.push(unit)
 		} else {
-			units.push(byte1)
+			units.push(0xFFFD) // replacement character for invalid lead byte
 		}
 
 		if (units.length >= 0x1000) {

package/dist/decode-no-eval.cjs

@@ -274,6 +274,7 @@
 					}
 					token = dataView.getUint32(position);
 					position += 4;
+					if (majorType === 1) return -1 - token; // can't safely use negation operator here
 					break
 				case 0x1b:
 					if (majorType == 7) {
@@ -288,8 +289,7 @@
 					} else if (currentDecoder.int64AsNumber) {
 						token = dataView.getUint32(position) * 0x100000000;
 						token += dataView.getUint32(position + 4);
-					} else
-						token = dataView.getBigUint64(position);
+					} else token = dataView.getBigUint64(position);
 					position += 8;
 					break
 				case 0x1f: 
@@ -606,26 +606,45 @@
 			} else if ((byte1 & 0xe0) === 0xc0) {
 				// 2 bytes
 				const byte2 = src[position++] & 0x3f;
-				units.push(((byte1 & 0x1f) << 6) | byte2);
+				const codePoint = ((byte1 & 0x1f) << 6) | byte2;
+				// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
+				if (codePoint < 0x80) {
+					units.push(0xFFFD); // replacement character
+				} else {
+					units.push(codePoint);
+				}
 			} else if ((byte1 & 0xf0) === 0xe0) {
 				// 3 bytes
 				const byte2 = src[position++] & 0x3f;
 				const byte3 = src[position++] & 0x3f;
-				units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3);
+				const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
+				// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
+				// Also reject surrogates (0xD800-0xDFFF)
+				if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
+					units.push(0xFFFD); // replacement character
+				} else {
+					units.push(codePoint);
+				}
 			} else if ((byte1 & 0xf8) === 0xf0) {
 				// 4 bytes
 				const byte2 = src[position++] & 0x3f;
 				const byte3 = src[position++] & 0x3f;
 				const byte4 = src[position++] & 0x3f;
 				let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-				if (unit > 0xffff) {
+				// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
+				// Also reject values > 0x10FFFF (maximum valid Unicode)
+				if (unit < 0x10000 || unit > 0x10FFFF) {
+					units.push(0xFFFD); // replacement character
+				} else if (unit > 0xffff) {
 					unit -= 0x10000;
 					units.push(((unit >>> 10) & 0x3ff) | 0xd800);
 					unit = 0xdc00 | (unit & 0x3ff);
+					units.push(unit);
+				} else {
+					units.push(unit);
 				}
-				units.push(unit);
 			} else {
-				units.push(byte1);
+				units.push(0xFFFD); // replacement character for invalid lead byte
 			}
 
 			if (units.length >= 0x1000) {