cbor-x 1.6.3 → 1.6.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/decode.js +24 -5
- package/dist/decode-no-eval.cjs +24 -5
- package/dist/decode-no-eval.cjs.map +1 -1
- package/dist/index-no-eval.cjs +24 -5
- package/dist/index-no-eval.cjs.map +1 -1
- package/dist/index-no-eval.min.js +1 -1
- package/dist/index-no-eval.min.js.map +1 -1
- package/dist/index.js +24 -5
- package/dist/index.js.map +1 -1
- package/dist/index.min.js +1 -1
- package/dist/index.min.js.map +1 -1
- package/dist/node.cjs +24 -5
- package/dist/node.cjs.map +1 -1
- package/dist/test.js +30 -5
- package/dist/test.js.map +1 -1
- package/package.json +2 -2
package/dist/node.cjs
CHANGED
|
@@ -601,26 +601,45 @@ function readStringJS(length) {
|
|
|
601
601
|
} else if ((byte1 & 0xe0) === 0xc0) {
|
|
602
602
|
// 2 bytes
|
|
603
603
|
const byte2 = src[position$1++] & 0x3f;
|
|
604
|
-
|
|
604
|
+
const codePoint = ((byte1 & 0x1f) << 6) | byte2;
|
|
605
|
+
// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
|
|
606
|
+
if (codePoint < 0x80) {
|
|
607
|
+
units.push(0xFFFD); // replacement character
|
|
608
|
+
} else {
|
|
609
|
+
units.push(codePoint);
|
|
610
|
+
}
|
|
605
611
|
} else if ((byte1 & 0xf0) === 0xe0) {
|
|
606
612
|
// 3 bytes
|
|
607
613
|
const byte2 = src[position$1++] & 0x3f;
|
|
608
614
|
const byte3 = src[position$1++] & 0x3f;
|
|
609
|
-
|
|
615
|
+
const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
|
|
616
|
+
// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
|
|
617
|
+
// Also reject surrogates (0xD800-0xDFFF)
|
|
618
|
+
if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
|
|
619
|
+
units.push(0xFFFD); // replacement character
|
|
620
|
+
} else {
|
|
621
|
+
units.push(codePoint);
|
|
622
|
+
}
|
|
610
623
|
} else if ((byte1 & 0xf8) === 0xf0) {
|
|
611
624
|
// 4 bytes
|
|
612
625
|
const byte2 = src[position$1++] & 0x3f;
|
|
613
626
|
const byte3 = src[position$1++] & 0x3f;
|
|
614
627
|
const byte4 = src[position$1++] & 0x3f;
|
|
615
628
|
let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
|
|
616
|
-
|
|
629
|
+
// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
|
|
630
|
+
// Also reject values > 0x10FFFF (maximum valid Unicode)
|
|
631
|
+
if (unit < 0x10000 || unit > 0x10FFFF) {
|
|
632
|
+
units.push(0xFFFD); // replacement character
|
|
633
|
+
} else if (unit > 0xffff) {
|
|
617
634
|
unit -= 0x10000;
|
|
618
635
|
units.push(((unit >>> 10) & 0x3ff) | 0xd800);
|
|
619
636
|
unit = 0xdc00 | (unit & 0x3ff);
|
|
637
|
+
units.push(unit);
|
|
638
|
+
} else {
|
|
639
|
+
units.push(unit);
|
|
620
640
|
}
|
|
621
|
-
units.push(unit);
|
|
622
641
|
} else {
|
|
623
|
-
units.push(
|
|
642
|
+
units.push(0xFFFD); // replacement character for invalid lead byte
|
|
624
643
|
}
|
|
625
644
|
|
|
626
645
|
if (units.length >= 0x1000) {
|