cbor-x 1.6.0 → 1.6.4

package/dist/index.js

@@ -264,6 +264,7 @@
 					}
 					token = dataView.getUint32(position$1);
 					position$1 += 4;
+					if (majorType === 1) return -1 - token; // can't safely use negation operator here
 					break
 				case 0x1b:
 					if (majorType == 7) {
@@ -278,8 +279,7 @@
 					} else if (currentDecoder.int64AsNumber) {
 						token = dataView.getUint32(position$1) * 0x100000000;
 						token += dataView.getUint32(position$1 + 4);
-					} else
-						token = dataView.getBigUint64(position$1);
+					} else token = dataView.getBigUint64(position$1);
 					position$1 += 8;
 					break
 				case 0x1f: 
@@ -561,26 +561,45 @@
 			} else if ((byte1 & 0xe0) === 0xc0) {
 				// 2 bytes
 				const byte2 = src[position$1++] & 0x3f;
-				units.push(((byte1 & 0x1f) << 6) | byte2);
+				const codePoint = ((byte1 & 0x1f) << 6) | byte2;
+				// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
+				if (codePoint < 0x80) {
+					units.push(0xFFFD); // replacement character
+				} else {
+					units.push(codePoint);
+				}
 			} else if ((byte1 & 0xf0) === 0xe0) {
 				// 3 bytes
 				const byte2 = src[position$1++] & 0x3f;
 				const byte3 = src[position$1++] & 0x3f;
-				units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3);
+				const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
+				// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
+				// Also reject surrogates (0xD800-0xDFFF)
+				if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
+					units.push(0xFFFD); // replacement character
+				} else {
+					units.push(codePoint);
+				}
 			} else if ((byte1 & 0xf8) === 0xf0) {
 				// 4 bytes
 				const byte2 = src[position$1++] & 0x3f;
 				const byte3 = src[position$1++] & 0x3f;
 				const byte4 = src[position$1++] & 0x3f;
 				let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-				if (unit > 0xffff) {
+				// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
+				// Also reject values > 0x10FFFF (maximum valid Unicode)
+				if (unit < 0x10000 || unit > 0x10FFFF) {
+					units.push(0xFFFD); // replacement character
+				} else if (unit > 0xffff) {
 					unit -= 0x10000;
 					units.push(((unit >>> 10) & 0x3ff) | 0xd800);
 					unit = 0xdc00 | (unit & 0x3ff);
+					units.push(unit);
+				} else {
+					units.push(unit);
 				}
-				units.push(unit);
 			} else {
-				units.push(byte1);
+				units.push(0xFFFD); // replacement character for invalid lead byte
 			}
 
 			if (units.length >= 0x1000) {
@@ -1205,8 +1224,8 @@
 			let structures;
 			let referenceMap;
 			options = options || {};
-			let encodeUtf8 = ByteArray.prototype.utf8Write ? function(string, position, maxBytes) {
-				return target.utf8Write(string, position, maxBytes)
+			let encodeUtf8 = ByteArray.prototype.utf8Write ? function(string, position) {
+				return target.utf8Write(string, position, target.byteLength - position)
 			} : (textEncoder && textEncoder.encodeInto) ?
 				function(string, position) {
 					return textEncoder.encodeInto(string, target.subarray(position)).written
@@ -1587,7 +1606,7 @@
 							targetView.setUint32(position, value);
 							position += 4;
 						}
-					} else if (!this.alwaysUseFloat && value >> 0 === value) { // negative integer
+					} else if (!this.alwaysUseFloat && value >> 0 === value) { // negative integer, 31-bit or less
 						if (value >= -0x18) {
 							target[position++] = 0x1f - value;
 						} else if (value >= -0x100) {
@@ -1602,6 +1621,11 @@
 							targetView.setUint32(position, ~value);
 							position += 4;
 						}
+					} else if (!this.alwaysUseFloat && value < 0 && value >= -0x100000000 && Math.floor(value) === value) {
+						// negative integer, 32-bit or less
+						target[position++] = 0x3a;
+						targetView.setUint32(position, -1 - value);
+						position += 4;
 					} else {
 						let useFloat32;
 						if ((useFloat32 = this.useFloat32) > 0 && value < 0x100000000 && value >= -0x80000000) {
@@ -1643,6 +1667,9 @@
 						}
 						let constructor = value.constructor;
 						if (constructor === Object) {
+							if (this.skipFunction === true) {
+								value = Object.fromEntries([...Object.keys(value).filter(x => typeof value[x] !== "function").map(x => [x, value[x]])]);
+							}
 							writeObject(value);
 						} else if (constructor === Array) {
 							length = value.length;