cbor-x 1.6.3 → 1.6.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/decode.js +24 -5
- package/dist/decode-no-eval.cjs +24 -5
- package/dist/decode-no-eval.cjs.map +1 -1
- package/dist/index-no-eval.cjs +24 -5
- package/dist/index-no-eval.cjs.map +1 -1
- package/dist/index-no-eval.min.js +1 -1
- package/dist/index-no-eval.min.js.map +1 -1
- package/dist/index.js +24 -5
- package/dist/index.js.map +1 -1
- package/dist/index.min.js +1 -1
- package/dist/index.min.js.map +1 -1
- package/dist/node.cjs +24 -5
- package/dist/node.cjs.map +1 -1
- package/dist/test.js +30 -5
- package/dist/test.js.map +1 -1
- package/package.json +2 -2
package/dist/index.js
CHANGED
|
@@ -561,26 +561,45 @@
|
|
|
561
561
|
} else if ((byte1 & 0xe0) === 0xc0) {
|
|
562
562
|
// 2 bytes
|
|
563
563
|
const byte2 = src[position$1++] & 0x3f;
|
|
564
|
-
|
|
564
|
+
const codePoint = ((byte1 & 0x1f) << 6) | byte2;
|
|
565
|
+
// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
|
|
566
|
+
if (codePoint < 0x80) {
|
|
567
|
+
units.push(0xFFFD); // replacement character
|
|
568
|
+
} else {
|
|
569
|
+
units.push(codePoint);
|
|
570
|
+
}
|
|
565
571
|
} else if ((byte1 & 0xf0) === 0xe0) {
|
|
566
572
|
// 3 bytes
|
|
567
573
|
const byte2 = src[position$1++] & 0x3f;
|
|
568
574
|
const byte3 = src[position$1++] & 0x3f;
|
|
569
|
-
|
|
575
|
+
const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
|
|
576
|
+
// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
|
|
577
|
+
// Also reject surrogates (0xD800-0xDFFF)
|
|
578
|
+
if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
|
|
579
|
+
units.push(0xFFFD); // replacement character
|
|
580
|
+
} else {
|
|
581
|
+
units.push(codePoint);
|
|
582
|
+
}
|
|
570
583
|
} else if ((byte1 & 0xf8) === 0xf0) {
|
|
571
584
|
// 4 bytes
|
|
572
585
|
const byte2 = src[position$1++] & 0x3f;
|
|
573
586
|
const byte3 = src[position$1++] & 0x3f;
|
|
574
587
|
const byte4 = src[position$1++] & 0x3f;
|
|
575
588
|
let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
|
|
576
|
-
|
|
589
|
+
// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
|
|
590
|
+
// Also reject values > 0x10FFFF (maximum valid Unicode)
|
|
591
|
+
if (unit < 0x10000 || unit > 0x10FFFF) {
|
|
592
|
+
units.push(0xFFFD); // replacement character
|
|
593
|
+
} else if (unit > 0xffff) {
|
|
577
594
|
unit -= 0x10000;
|
|
578
595
|
units.push(((unit >>> 10) & 0x3ff) | 0xd800);
|
|
579
596
|
unit = 0xdc00 | (unit & 0x3ff);
|
|
597
|
+
units.push(unit);
|
|
598
|
+
} else {
|
|
599
|
+
units.push(unit);
|
|
580
600
|
}
|
|
581
|
-
units.push(unit);
|
|
582
601
|
} else {
|
|
583
|
-
units.push(
|
|
602
|
+
units.push(0xFFFD); // replacement character for invalid lead byte
|
|
584
603
|
}
|
|
585
604
|
|
|
586
605
|
if (units.length >= 0x1000) {
|