cbor-x 1.6.3 → 1.6.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/decode.js +40 -15
  2. package/dist/decode-no-eval.cjs +40 -15
  3. package/dist/decode-no-eval.cjs.map +1 -1
  4. package/dist/index-no-eval.cjs +40 -15
  5. package/dist/index-no-eval.cjs.map +1 -1
  6. package/dist/index-no-eval.min.js +1 -1
  7. package/dist/index-no-eval.min.js.map +1 -1
  8. package/dist/index.js +40 -15
  9. package/dist/index.js.map +1 -1
  10. package/dist/index.min.js +1 -1
  11. package/dist/index.min.js.map +1 -1
  12. package/dist/node.cjs +42 -16
  13. package/dist/node.cjs.map +1 -1
  14. package/dist/test.js +49 -17
  15. package/dist/test.js.map +1 -1
  16. package/package.json +2 -2
package/dist/test.js CHANGED
@@ -1,6 +1,7 @@
1
1
  (function (stream, module, chai, fs) {
2
2
  'use strict';
3
3
 
4
+ var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
4
5
  let decoder;
5
6
  try {
6
7
  decoder = new TextDecoder();
@@ -595,27 +596,52 @@
595
596
  units.push(byte1);
596
597
  } else if ((byte1 & 0xe0) === 0xc0) {
597
598
  // 2 bytes
598
- const byte2 = src[position$1++] & 0x3f;
599
- units.push(((byte1 & 0x1f) << 6) | byte2);
599
+ if (byte1 < 0xc2 || position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
600
+ units.push(0xFFFD);
601
+ } else {
602
+ const byte2 = src[position$1++] & 0x3f;
603
+ units.push(((byte1 & 0x1f) << 6) | byte2);
604
+ }
600
605
  } else if ((byte1 & 0xf0) === 0xe0) {
601
606
  // 3 bytes
602
- const byte2 = src[position$1++] & 0x3f;
603
- const byte3 = src[position$1++] & 0x3f;
604
- units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3);
607
+ const byte2 = position$1 < end ? src[position$1] : 0;
608
+ if (position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
609
+ (byte1 === 0xe0 && byte2 < 0xa0) || (byte1 === 0xed && byte2 >= 0xa0)) {
610
+ units.push(0xFFFD);
611
+ } else {
612
+ position$1++;
613
+ if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
614
+ units.push(0xFFFD);
615
+ } else {
616
+ const byte3 = src[position$1++] & 0x3f;
617
+ units.push(((byte1 & 0x1f) << 12) | ((byte2 & 0x3f) << 6) | byte3);
618
+ }
619
+ }
605
620
  } else if ((byte1 & 0xf8) === 0xf0) {
606
621
  // 4 bytes
607
- const byte2 = src[position$1++] & 0x3f;
608
- const byte3 = src[position$1++] & 0x3f;
609
- const byte4 = src[position$1++] & 0x3f;
610
- let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
611
- if (unit > 0xffff) {
612
- unit -= 0x10000;
613
- units.push(((unit >>> 10) & 0x3ff) | 0xd800);
614
- unit = 0xdc00 | (unit & 0x3ff);
622
+ const byte2 = position$1 < end ? src[position$1] : 0;
623
+ if (byte1 > 0xf4 || position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
624
+ (byte1 === 0xf0 && byte2 < 0x90) || (byte1 === 0xf4 && byte2 >= 0x90)) {
625
+ units.push(0xFFFD);
626
+ } else {
627
+ position$1++;
628
+ if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
629
+ units.push(0xFFFD);
630
+ } else {
631
+ const byte3 = src[position$1++] & 0x3f;
632
+ if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
633
+ units.push(0xFFFD);
634
+ } else {
635
+ const byte4 = src[position$1++] & 0x3f;
636
+ let unit = ((byte1 & 0x07) << 0x12) | ((byte2 & 0x3f) << 0x0c) | (byte3 << 0x06) | byte4;
637
+ unit -= 0x10000;
638
+ units.push(((unit >>> 10) & 0x3ff) | 0xd800);
639
+ units.push(0xdc00 | (unit & 0x3ff));
640
+ }
641
+ }
615
642
  }
616
- units.push(unit);
617
643
  } else {
618
- units.push(byte1);
644
+ units.push(0xFFFD); // replacement character for invalid lead byte
619
645
  }
620
646
 
621
647
  if (units.length >= 0x1000) {
@@ -2443,7 +2469,7 @@
2443
2469
  if (typeof require == 'function')
2444
2470
  extractor = require('cbor-extract');
2445
2471
  else
2446
- extractor = module.createRequire((document.currentScript && document.currentScript.src || new URL('test.js', document.baseURI).href))('cbor-extract');
2472
+ extractor = module.createRequire((_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('test.js', document.baseURI).href))('cbor-extract');
2447
2473
  if (extractor)
2448
2474
  setExtractor(extractor.extractStrings);
2449
2475
  } catch (error) {
@@ -2451,7 +2477,7 @@
2451
2477
  }
2452
2478
  }
2453
2479
 
2454
- const sampleData = JSON.parse(fs.readFileSync(new URL('./example4.json', (document.currentScript && document.currentScript.src || new URL('test.js', document.baseURI).href))));
2480
+ const sampleData = JSON.parse(fs.readFileSync(new URL('./example4.json', (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('test.js', document.baseURI).href))));
2455
2481
 
2456
2482
  const senmlData = [
2457
2483
  { bn: '/3303/0/5700', bt: 1278887, v: 35.5 },
@@ -2607,6 +2633,12 @@
2607
2633
  assert.throws(() => decode$1(Buffer.from('7a10000000', 'hex')));
2608
2634
  });
2609
2635
 
2636
+ test('overlong encoding', function() {
2637
+ const payload = Buffer.from([0x62, 0xc0, 0xaf]);
2638
+ const result = decode$1(payload);
2639
+ assert.notEqual(result, '/');
2640
+ });
2641
+
2610
2642
  test('encode/decode sample data', function(){
2611
2643
  var data = sampleData;
2612
2644
  var serialized = encode$1(data);