cbor-x 1.6.0 → 1.6.4

package/dist/test.js

@@ -267,6 +267,7 @@
 					}
 					token = dataView.getUint32(position$1);
 					position$1 += 4;
+					if (majorType === 1) return -1 - token; // can't safely use negation operator here
 					break
 				case 0x1b:
 					if (majorType == 7) {
@@ -281,8 +282,7 @@
 					} else if (currentDecoder.int64AsNumber) {
 						token = dataView.getUint32(position$1) * 0x100000000;
 						token += dataView.getUint32(position$1 + 4);
-					} else
-						token = dataView.getBigUint64(position$1);
+					} else token = dataView.getBigUint64(position$1);
 					position$1 += 8;
 					break
 				case 0x1f: 
@@ -596,26 +596,45 @@
 			} else if ((byte1 & 0xe0) === 0xc0) {
 				// 2 bytes
 				const byte2 = src[position$1++] & 0x3f;
-				units.push(((byte1 & 0x1f) << 6) | byte2);
+				const codePoint = ((byte1 & 0x1f) << 6) | byte2;
+				// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
+				if (codePoint < 0x80) {
+					units.push(0xFFFD); // replacement character
+				} else {
+					units.push(codePoint);
+				}
 			} else if ((byte1 & 0xf0) === 0xe0) {
 				// 3 bytes
 				const byte2 = src[position$1++] & 0x3f;
 				const byte3 = src[position$1++] & 0x3f;
-				units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3);
+				const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
+				// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
+				// Also reject surrogates (0xD800-0xDFFF)
+				if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
+					units.push(0xFFFD); // replacement character
+				} else {
+					units.push(codePoint);
+				}
 			} else if ((byte1 & 0xf8) === 0xf0) {
 				// 4 bytes
 				const byte2 = src[position$1++] & 0x3f;
 				const byte3 = src[position$1++] & 0x3f;
 				const byte4 = src[position$1++] & 0x3f;
 				let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-				if (unit > 0xffff) {
+				// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
+				// Also reject values > 0x10FFFF (maximum valid Unicode)
+				if (unit < 0x10000 || unit > 0x10FFFF) {
+					units.push(0xFFFD); // replacement character
+				} else if (unit > 0xffff) {
 					unit -= 0x10000;
 					units.push(((unit >>> 10) & 0x3ff) | 0xd800);
 					unit = 0xdc00 | (unit & 0x3ff);
+					units.push(unit);
+				} else {
+					units.push(unit);
 				}
-				units.push(unit);
 			} else {
-				units.push(byte1);
+				units.push(0xFFFD); // replacement character for invalid lead byte
 			}
 
 			if (units.length >= 0x1000) {
@@ -1233,8 +1252,8 @@
 			let structures;
 			let referenceMap;
 			options = options || {};
-			let encodeUtf8 = ByteArray.prototype.utf8Write ? function(string, position, maxBytes) {
-				return target.utf8Write(string, position, maxBytes)
+			let encodeUtf8 = ByteArray.prototype.utf8Write ? function(string, position) {
+				return target.utf8Write(string, position, target.byteLength - position)
 			} : (textEncoder && textEncoder.encodeInto) ?
 				function(string, position) {
 					return textEncoder.encodeInto(string, target.subarray(position)).written
@@ -1615,7 +1634,7 @@
 							targetView.setUint32(position, value);
 							position += 4;
 						}
-					} else if (!this.alwaysUseFloat && value >> 0 === value) { // negative integer
+					} else if (!this.alwaysUseFloat && value >> 0 === value) { // negative integer, 31-bit or less
 						if (value >= -0x18) {
 							target[position++] = 0x1f - value;
 						} else if (value >= -0x100) {
@@ -1630,6 +1649,11 @@
 							targetView.setUint32(position, ~value);
 							position += 4;
 						}
+					} else if (!this.alwaysUseFloat && value < 0 && value >= -0x100000000 && Math.floor(value) === value) {
+						// negative integer, 32-bit or less
+						target[position++] = 0x3a;
+						targetView.setUint32(position, -1 - value);
+						position += 4;
 					} else {
 						let useFloat32;
 						if ((useFloat32 = this.useFloat32) > 0 && value < 0x100000000 && value >= -0x80000000) {
@@ -1671,6 +1695,9 @@
 						}
 						let constructor = value.constructor;
 						if (constructor === Object) {
+							if (this.skipFunction === true) {
+								value = Object.fromEntries([...Object.keys(value).filter(x => typeof value[x] !== "function").map(x => [x, value[x]])]);
+							}
 							writeObject(value);
 						} else if (constructor === Array) {
 							length = value.length;
@@ -2595,6 +2622,16 @@
 			assert.equal(deserialized, data);
 		});
 
+		test('string overflow', function() {
+			assert.throws(() => decode$1(Buffer.from('7a10000000', 'hex')));
+		});
+
+		test('overlong encoding', function() {
+			const payload = Buffer.from([0x62, 0xc0, 0xaf]);
+			const result = decode$1(payload);
+			assert.notEqual(result, '/');
+		});
+
 		test('encode/decode sample data', function(){
 			var data = sampleData;
 			var serialized = encode$1(data);
@@ -3082,7 +3119,12 @@
 			var deserialized = decode(serialized);
 			assert.deepEqual(deserialized, data);
 		});
-
+		test('numbers are compact', function(){
+			assert.equal(encode(-256).length, 2);
+			let encoding = encode(-4294967296);
+			assert.equal(encoding.length, 5);
+			assert.equal(decode(encoding), -4294967296);
+		});
 		test('encode ArrayBuffer', function() {
 			let ua = new Uint8Array([3, 4, 5]);
 			let encoded = encode(ua.buffer);
@@ -3181,6 +3223,20 @@
 			decodeMultiple(new Uint8Array([1, 2, 3, 4]), value => values.push(value));
 			assert.deepEqual(values, [1, 2, 3, 4]);
 		});
+		test('skipFunction', () => {
+			var data = {
+				a: 325283295382932843n,
+				f: () => {},
+			};
+			let encoder = new Encoder({
+				int64AsNumber: true,
+				skipFunction: true,
+			});
+			var serialized = encoder.encode(data);
+			var deserialized = encoder.decode(serialized);
+			assert.deepEqual(deserialized.a, 325283295382932843);
+			assert.equal(Object.hasOwn(deserialized, "f"), false);
+		});
 		test('bad input', function() {
 			let badInput = Buffer.from('7b2273657269616c6e6f223a2265343a30222c226970223a223139322e3136382e312e3335222c226b6579223a226770735f736563726574227d', 'hex');
 			assert.throws(function(){ decode(badInput); }); // should throw, not crash