cbor-x 1.6.0 → 1.6.4

package/dist/node.cjs

@@ -269,6 +269,7 @@ function read() {
 				}
 				token = dataView.getUint32(position$1);
 				position$1 += 4;
+				if (majorType === 1) return -1 - token; // can't safely use negation operator here
 				break
 			case 0x1b:
 				if (majorType == 7) {
@@ -283,8 +284,7 @@ function read() {
 				} else if (currentDecoder.int64AsNumber) {
 					token = dataView.getUint32(position$1) * 0x100000000;
 					token += dataView.getUint32(position$1 + 4);
-				} else
-					token = dataView.getBigUint64(position$1);
+				} else token = dataView.getBigUint64(position$1);
 				position$1 += 8;
 				break
 			case 0x1f: 
@@ -601,26 +601,45 @@ function readStringJS(length) {
 		} else if ((byte1 & 0xe0) === 0xc0) {
 			// 2 bytes
 			const byte2 = src[position$1++] & 0x3f;
-			units.push(((byte1 & 0x1f) << 6) | byte2);
+			const codePoint = ((byte1 & 0x1f) << 6) | byte2;
+			// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
+			if (codePoint < 0x80) {
+				units.push(0xFFFD); // replacement character
+			} else {
+				units.push(codePoint);
+			}
 		} else if ((byte1 & 0xf0) === 0xe0) {
 			// 3 bytes
 			const byte2 = src[position$1++] & 0x3f;
 			const byte3 = src[position$1++] & 0x3f;
-			units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3);
+			const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
+			// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
+			// Also reject surrogates (0xD800-0xDFFF)
+			if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
+				units.push(0xFFFD); // replacement character
+			} else {
+				units.push(codePoint);
+			}
 		} else if ((byte1 & 0xf8) === 0xf0) {
 			// 4 bytes
 			const byte2 = src[position$1++] & 0x3f;
 			const byte3 = src[position$1++] & 0x3f;
 			const byte4 = src[position$1++] & 0x3f;
 			let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-			if (unit > 0xffff) {
+			// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
+			// Also reject values > 0x10FFFF (maximum valid Unicode)
+			if (unit < 0x10000 || unit > 0x10FFFF) {
+				units.push(0xFFFD); // replacement character
+			} else if (unit > 0xffff) {
 				unit -= 0x10000;
 				units.push(((unit >>> 10) & 0x3ff) | 0xd800);
 				unit = 0xdc00 | (unit & 0x3ff);
+				units.push(unit);
+			} else {
+				units.push(unit);
 			}
-			units.push(unit);
 		} else {
-			units.push(byte1);
+			units.push(0xFFFD); // replacement character for invalid lead byte
 		}
 
 		if (units.length >= 0x1000) {
@@ -1249,8 +1268,8 @@ class Encoder extends Decoder {
 		let structures;
 		let referenceMap;
 		options = options || {};
-		let encodeUtf8 = ByteArray.prototype.utf8Write ? function(string, position, maxBytes) {
-			return target.utf8Write(string, position, maxBytes)
+		let encodeUtf8 = ByteArray.prototype.utf8Write ? function(string, position) {
+			return target.utf8Write(string, position, target.byteLength - position)
 		} : (textEncoder && textEncoder.encodeInto) ?
 			function(string, position) {
 				return textEncoder.encodeInto(string, target.subarray(position)).written
@@ -1631,7 +1650,7 @@ class Encoder extends Decoder {
 						targetView.setUint32(position, value);
 						position += 4;
 					}
-				} else if (!this.alwaysUseFloat && value >> 0 === value) { // negative integer
+				} else if (!this.alwaysUseFloat && value >> 0 === value) { // negative integer, 31-bit or less
 					if (value >= -0x18) {
 						target[position++] = 0x1f - value;
 					} else if (value >= -0x100) {
@@ -1646,6 +1665,11 @@ class Encoder extends Decoder {
 						targetView.setUint32(position, ~value);
 						position += 4;
 					}
+				} else if (!this.alwaysUseFloat && value < 0 && value >= -0x100000000 && Math.floor(value) === value) {
+					// negative integer, 32-bit or less
+					target[position++] = 0x3a;
+					targetView.setUint32(position, -1 - value);
+					position += 4;
 				} else {
 					let useFloat32;
 					if ((useFloat32 = this.useFloat32) > 0 && value < 0x100000000 && value >= -0x80000000) {
@@ -1687,6 +1711,9 @@ class Encoder extends Decoder {
 					}
 					let constructor = value.constructor;
 					if (constructor === Object) {
+						if (this.skipFunction === true) {
+							value = Object.fromEntries([...Object.keys(value).filter(x => typeof value[x] !== "function").map(x => [x, value[x]])]);
+						}
 						writeObject(value);
 					} else if (constructor === Array) {
 						length = value.length;