cbor-x 1.6.4 → 1.6.6

package/README.md

@@ -230,17 +230,19 @@ Note, that the performance is decreased with decimal rounding by about 20-25%, a
 In addition, msgpackr exports a `roundFloat32(number)` function that can be used to round floating point numbers to the maximum significant decimal digits that can be stored in 32-bit float, just as DECIMAL_ROUND does when decoding. This can be useful for determining how a number will be decoded prior to encoding it.
 
 ### Setting Size Limits
-You can set size limits on objects, arrays, and maps to prevent resource exhaustion when decoding. This can be done by calling the setMaxLimits export. Each of the properties are optional (only provide 
+You can set size limits on objects, arrays, and maps to prevent resource exhaustion when decoding. This can be done by calling the setSizeLimits export. Each of the properties are optional (only provide 
 the properties you want to change), for example (with the defaults):
 ```JavaScript
-import { setMaxLimits } from 'cbor-x';
-setMaxLimits({
+import { setSizeLimits } from 'cbor-x';
+setSizeLimits({
 	maxArraySize: 112810000, 
 	maxMapSize: 16810000,
 	maxObjectSize : 16710000
 });
 ```
 
+Declared array and map lengths are also always validated against the number of bytes remaining in the source, so truncated or malformed input is rejected immediately instead of allocating for the length it claims. These limits are for bounding legitimately encoded (but unwanted) large data.
+
 ## Performance
 Cbor-x is fast. Really fast. Here is comparison with the next fastest JS projects using the benchmark tool from `msgpack-lite` (and the sample data is from some clinical research data we use that has a good mix of different value types and structures). It also includes comparison to V8 native JSON functionality, and JavaScript Avro (`avsc`, a very optimized Avro implementation):
 

package/decode.d.ts

@@ -1,2 +1,2 @@
 export { decode, decodeMultiple, Decoder, addExtension, clearSource,roundFloat32, isNativeAccelerationEnabled,
-	Extension, Options, FLOAT32_OPTIONS, setMaxLimits, MAX_LIMITS_OPTIONS } from '.'
+	Extension, Options, FLOAT32_OPTIONS, setSizeLimits, SizeLimitOptions } from '.'

package/decode.js

@@ -243,13 +243,22 @@ export function checkedRead() {
 	}
 }
 
+function endOfCBORError() {
+	let error = new Error('Unexpected end of CBOR data')
+	error.incomplete = true
+	return error
+}
+
 export function read() {
+	// compared as < so that a NaN position (from a corrupt length) also throws instead of reading undefined
+	if (!(position < srcEnd)) throw endOfCBORError()
 	let token = src[position++]
 	let majorType = token >> 5
 	token = token & 0x1f
 	if (token > 0x17) {
 		switch (token) {
 			case 0x18:
+				if (position >= srcEnd) throw endOfCBORError()
 				token = src[position++]
 				break
 			case 0x19:
@@ -378,6 +387,9 @@ export function read() {
 			return readFixedString(token)
 		case 4: // array
 			if (token >= maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
+			// every element occupies at least one byte, so a length beyond what remains in the source can
+			// never be satisfied; check before allocating so a tiny header can not force a huge allocation
+			if (token > srcEnd - position) throw endOfCBORError()
 			let array = new Array(token)
 		  //if (currentDecoder.keyMap) for (let i = 0; i < token; i++) array[i] = currentDecoder.decodeKey(read())	
 			//else 
@@ -385,6 +397,7 @@ export function read() {
 			return array
 		case 5: // map
 			if (token >= maxMapSize) throw new Error(`Map size exceeds ${maxArraySize}`)
+			if (token > (srcEnd - position) / 2) throw endOfCBORError() // each entry needs at least two bytes
 			if (currentDecoder.mapsAsObjects) {
 				let object = {}
 				if (currentDecoder.keyMap) for (let i = 0; i < token; i++) object[safeKey(currentDecoder.decodeKey(read()))] = read()
@@ -476,11 +489,7 @@ export function read() {
 					throw new Error('Unknown token ' + token)
 			}
 		default: // negative int
-			if (isNaN(token)) {
-				let error = new Error('Unexpected end of CBOR data')
-				error.incomplete = true
-				throw error
-			}
+			if (isNaN(token)) throw endOfCBORError()
 			throw new Error('Unknown CBOR token ' + token)
 	}
 }
@@ -610,43 +619,49 @@ function readStringJS(length) {
 			units.push(byte1)
 		} else if ((byte1 & 0xe0) === 0xc0) {
 			// 2 bytes
-			const byte2 = src[position++] & 0x3f
-			const codePoint = ((byte1 & 0x1f) << 6) | byte2
-			// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
-			if (codePoint < 0x80) {
-				units.push(0xFFFD) // replacement character
+			if (byte1 < 0xc2 || position >= end || (src[position] & 0xc0) !== 0x80) {
+				units.push(0xFFFD)
 			} else {
-				units.push(codePoint)
+				const byte2 = src[position++] & 0x3f
+				units.push(((byte1 & 0x1f) << 6) | byte2)
 			}
 		} else if ((byte1 & 0xf0) === 0xe0) {
 			// 3 bytes
-			const byte2 = src[position++] & 0x3f
-			const byte3 = src[position++] & 0x3f
-			const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3
-			// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
-			// Also reject surrogates (0xD800-0xDFFF)
-			if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
-				units.push(0xFFFD) // replacement character
+			const byte2 = position < end ? src[position] : 0
+			if (position >= end || (byte2 & 0xc0) !== 0x80 ||
+				(byte1 === 0xe0 && byte2 < 0xa0) || (byte1 === 0xed && byte2 >= 0xa0)) {
+				units.push(0xFFFD)
 			} else {
-				units.push(codePoint)
+				position++
+				if (position >= end || (src[position] & 0xc0) !== 0x80) {
+					units.push(0xFFFD)
+				} else {
+					const byte3 = src[position++] & 0x3f
+					units.push(((byte1 & 0x1f) << 12) | ((byte2 & 0x3f) << 6) | byte3)
+				}
 			}
 		} else if ((byte1 & 0xf8) === 0xf0) {
 			// 4 bytes
-			const byte2 = src[position++] & 0x3f
-			const byte3 = src[position++] & 0x3f
-			const byte4 = src[position++] & 0x3f
-			let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4
-			// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
-			// Also reject values > 0x10FFFF (maximum valid Unicode)
-			if (unit < 0x10000 || unit > 0x10FFFF) {
-				units.push(0xFFFD) // replacement character
-			} else if (unit > 0xffff) {
-				unit -= 0x10000
-				units.push(((unit >>> 10) & 0x3ff) | 0xd800)
-				unit = 0xdc00 | (unit & 0x3ff)
-				units.push(unit)
+			const byte2 = position < end ? src[position] : 0
+			if (byte1 > 0xf4 || position >= end || (byte2 & 0xc0) !== 0x80 ||
+				(byte1 === 0xf0 && byte2 < 0x90) || (byte1 === 0xf4 && byte2 >= 0x90)) {
+				units.push(0xFFFD)
 			} else {
-				units.push(unit)
+				position++
+				if (position >= end || (src[position] & 0xc0) !== 0x80) {
+					units.push(0xFFFD)
+				} else {
+					const byte3 = src[position++] & 0x3f
+					if (position >= end || (src[position] & 0xc0) !== 0x80) {
+						units.push(0xFFFD)
+					} else {
+						const byte4 = src[position++] & 0x3f
+						let unit = ((byte1 & 0x07) << 0x12) | ((byte2 & 0x3f) << 0x0c) | (byte3 << 0x06) | byte4
+						unit -= 0x10000
+						units.push(((unit >>> 10) & 0x3ff) | 0xd800)
+						units.push(0xdc00 | (unit & 0x3ff))
+					}
+				}
 			}
 		} else {
 			units.push(0xFFFD) // replacement character for invalid lead byte
@@ -1214,10 +1229,12 @@ function readBundleExt() {
 }
 
 function readJustLength() {
+	if (!(position < srcEnd)) throw endOfCBORError()
 	let token = src[position++] & 0x1f
 	if (token > 0x17) {
 		switch (token) {
 			case 0x18:
+				if (position >= srcEnd) throw endOfCBORError()
 				token = src[position++]
 				break
 			case 0x19:

package/dist/decode-no-eval.cjs

@@ -244,13 +244,22 @@
 		}
 	}
 
+	function endOfCBORError() {
+		let error = new Error('Unexpected end of CBOR data');
+		error.incomplete = true;
+		return error
+	}
+
 	function read() {
+		// compared as < so that a NaN position (from a corrupt length) also throws instead of reading undefined
+		if (!(position < srcEnd)) throw endOfCBORError()
 		let token = src[position++];
 		let majorType = token >> 5;
 		token = token & 0x1f;
 		if (token > 0x17) {
 			switch (token) {
 				case 0x18:
+					if (position >= srcEnd) throw endOfCBORError()
 					token = src[position++];
 					break
 				case 0x19:
@@ -379,6 +388,9 @@
 				return readFixedString(token)
 			case 4: // array
 				if (token >= maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
+				// every element occupies at least one byte, so a length beyond what remains in the source can
+				// never be satisfied; check before allocating so a tiny header can not force a huge allocation
+				if (token > srcEnd - position) throw endOfCBORError()
 				let array = new Array(token);
 			  //if (currentDecoder.keyMap) for (let i = 0; i < token; i++) array[i] = currentDecoder.decodeKey(read())	
 				//else 
@@ -386,6 +398,7 @@
 				return array
 			case 5: // map
 				if (token >= maxMapSize) throw new Error(`Map size exceeds ${maxArraySize}`)
+				if (token > (srcEnd - position) / 2) throw endOfCBORError() // each entry needs at least two bytes
 				if (currentDecoder.mapsAsObjects) {
 					let object = {};
 					if (currentDecoder.keyMap) for (let i = 0; i < token; i++) object[safeKey(currentDecoder.decodeKey(read()))] = read();
@@ -477,11 +490,7 @@
 						throw new Error('Unknown token ' + token)
 				}
 			default: // negative int
-				if (isNaN(token)) {
-					let error = new Error('Unexpected end of CBOR data');
-					error.incomplete = true;
-					throw error
-				}
+				if (isNaN(token)) throw endOfCBORError()
 				throw new Error('Unknown CBOR token ' + token)
 		}
 	}
@@ -605,43 +614,49 @@
 				units.push(byte1);
 			} else if ((byte1 & 0xe0) === 0xc0) {
 				// 2 bytes
-				const byte2 = src[position++] & 0x3f;
-				const codePoint = ((byte1 & 0x1f) << 6) | byte2;
-				// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
-				if (codePoint < 0x80) {
-					units.push(0xFFFD); // replacement character
+				if (byte1 < 0xc2 || position >= end || (src[position] & 0xc0) !== 0x80) {
+					units.push(0xFFFD);
 				} else {
-					units.push(codePoint);
+					const byte2 = src[position++] & 0x3f;
+					units.push(((byte1 & 0x1f) << 6) | byte2);
 				}
 			} else if ((byte1 & 0xf0) === 0xe0) {
 				// 3 bytes
-				const byte2 = src[position++] & 0x3f;
-				const byte3 = src[position++] & 0x3f;
-				const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
-				// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
-				// Also reject surrogates (0xD800-0xDFFF)
-				if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
-					units.push(0xFFFD); // replacement character
+				const byte2 = position < end ? src[position] : 0;
+				if (position >= end || (byte2 & 0xc0) !== 0x80 ||
+					(byte1 === 0xe0 && byte2 < 0xa0) || (byte1 === 0xed && byte2 >= 0xa0)) {
+					units.push(0xFFFD);
 				} else {
-					units.push(codePoint);
+					position++;
+					if (position >= end || (src[position] & 0xc0) !== 0x80) {
+						units.push(0xFFFD);
+					} else {
+						const byte3 = src[position++] & 0x3f;
+						units.push(((byte1 & 0x1f) << 12) | ((byte2 & 0x3f) << 6) | byte3);
+					}
 				}
 			} else if ((byte1 & 0xf8) === 0xf0) {
 				// 4 bytes
-				const byte2 = src[position++] & 0x3f;
-				const byte3 = src[position++] & 0x3f;
-				const byte4 = src[position++] & 0x3f;
-				let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-				// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
-				// Also reject values > 0x10FFFF (maximum valid Unicode)
-				if (unit < 0x10000 || unit > 0x10FFFF) {
-					units.push(0xFFFD); // replacement character
-				} else if (unit > 0xffff) {
-					unit -= 0x10000;
-					units.push(((unit >>> 10) & 0x3ff) | 0xd800);
-					unit = 0xdc00 | (unit & 0x3ff);
-					units.push(unit);
+				const byte2 = position < end ? src[position] : 0;
+				if (byte1 > 0xf4 || position >= end || (byte2 & 0xc0) !== 0x80 ||
+					(byte1 === 0xf0 && byte2 < 0x90) || (byte1 === 0xf4 && byte2 >= 0x90)) {
+					units.push(0xFFFD);
 				} else {
-					units.push(unit);
+					position++;
+					if (position >= end || (src[position] & 0xc0) !== 0x80) {
+						units.push(0xFFFD);
+					} else {
+						const byte3 = src[position++] & 0x3f;
+						if (position >= end || (src[position] & 0xc0) !== 0x80) {
+							units.push(0xFFFD);
+						} else {
+							const byte4 = src[position++] & 0x3f;
+							let unit = ((byte1 & 0x07) << 0x12) | ((byte2 & 0x3f) << 0x0c) | (byte3 << 0x06) | byte4;
+							unit -= 0x10000;
+							units.push(((unit >>> 10) & 0x3ff) | 0xd800);
+							units.push(0xdc00 | (unit & 0x3ff));
+						}
+					}
 				}
 			} else {
 				units.push(0xFFFD); // replacement character for invalid lead byte
@@ -1139,10 +1154,12 @@
 	}
 
 	function readJustLength() {
+		if (!(position < srcEnd)) throw endOfCBORError()
 		let token = src[position++] & 0x1f;
 		if (token > 0x17) {
 			switch (token) {
 				case 0x18:
+					if (position >= srcEnd) throw endOfCBORError()
 					token = src[position++];
 					break
 				case 0x19: