cbor-x 1.6.4 → 1.6.6

package/dist/test.js

@@ -1,6 +1,7 @@
 (function (stream, module, chai, fs) {
 	'use strict';
 
+	var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
 	let decoder;
 	try {
 		decoder = new TextDecoder();
@@ -237,13 +238,22 @@
 		}
 	}
 
+	function endOfCBORError() {
+		let error = new Error('Unexpected end of CBOR data');
+		error.incomplete = true;
+		return error
+	}
+
 	function read() {
+		// compared as < so that a NaN position (from a corrupt length) also throws instead of reading undefined
+		if (!(position$1 < srcEnd)) throw endOfCBORError()
 		let token = src[position$1++];
 		let majorType = token >> 5;
 		token = token & 0x1f;
 		if (token > 0x17) {
 			switch (token) {
 				case 0x18:
+					if (position$1 >= srcEnd) throw endOfCBORError()
 					token = src[position$1++];
 					break
 				case 0x19:
@@ -372,6 +382,9 @@
 				return readFixedString(token)
 			case 4: // array
 				if (token >= maxArraySize) throw new Error(`Array length exceeds ${maxArraySize}`)
+				// every element occupies at least one byte, so a length beyond what remains in the source can
+				// never be satisfied; check before allocating so a tiny header can not force a huge allocation
+				if (token > srcEnd - position$1) throw endOfCBORError()
 				let array = new Array(token);
 			  //if (currentDecoder.keyMap) for (let i = 0; i < token; i++) array[i] = currentDecoder.decodeKey(read())	
 				//else 
@@ -379,6 +392,7 @@
 				return array
 			case 5: // map
 				if (token >= maxMapSize) throw new Error(`Map size exceeds ${maxArraySize}`)
+				if (token > (srcEnd - position$1) / 2) throw endOfCBORError() // each entry needs at least two bytes
 				if (currentDecoder.mapsAsObjects) {
 					let object = {};
 					if (currentDecoder.keyMap) for (let i = 0; i < token; i++) object[safeKey(currentDecoder.decodeKey(read()))] = read();
@@ -470,11 +484,7 @@
 						throw new Error('Unknown token ' + token)
 				}
 			default: // negative int
-				if (isNaN(token)) {
-					let error = new Error('Unexpected end of CBOR data');
-					error.incomplete = true;
-					throw error
-				}
+				if (isNaN(token)) throw endOfCBORError()
 				throw new Error('Unknown CBOR token ' + token)
 		}
 	}
@@ -595,43 +605,49 @@
 				units.push(byte1);
 			} else if ((byte1 & 0xe0) === 0xc0) {
 				// 2 bytes
-				const byte2 = src[position$1++] & 0x3f;
-				const codePoint = ((byte1 & 0x1f) << 6) | byte2;
-				// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
-				if (codePoint < 0x80) {
-					units.push(0xFFFD); // replacement character
+				if (byte1 < 0xc2 || position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+					units.push(0xFFFD);
 				} else {
-					units.push(codePoint);
+					const byte2 = src[position$1++] & 0x3f;
+					units.push(((byte1 & 0x1f) << 6) | byte2);
 				}
 			} else if ((byte1 & 0xf0) === 0xe0) {
 				// 3 bytes
-				const byte2 = src[position$1++] & 0x3f;
-				const byte3 = src[position$1++] & 0x3f;
-				const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
-				// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
-				// Also reject surrogates (0xD800-0xDFFF)
-				if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
-					units.push(0xFFFD); // replacement character
+				const byte2 = position$1 < end ? src[position$1] : 0;
+				if (position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
+					(byte1 === 0xe0 && byte2 < 0xa0) || (byte1 === 0xed && byte2 >= 0xa0)) {
+					units.push(0xFFFD);
 				} else {
-					units.push(codePoint);
+					position$1++;
+					if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+						units.push(0xFFFD);
+					} else {
+						const byte3 = src[position$1++] & 0x3f;
+						units.push(((byte1 & 0x1f) << 12) | ((byte2 & 0x3f) << 6) | byte3);
+					}
 				}
 			} else if ((byte1 & 0xf8) === 0xf0) {
 				// 4 bytes
-				const byte2 = src[position$1++] & 0x3f;
-				const byte3 = src[position$1++] & 0x3f;
-				const byte4 = src[position$1++] & 0x3f;
-				let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-				// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
-				// Also reject values > 0x10FFFF (maximum valid Unicode)
-				if (unit < 0x10000 || unit > 0x10FFFF) {
-					units.push(0xFFFD); // replacement character
-				} else if (unit > 0xffff) {
-					unit -= 0x10000;
-					units.push(((unit >>> 10) & 0x3ff) | 0xd800);
-					unit = 0xdc00 | (unit & 0x3ff);
-					units.push(unit);
+				const byte2 = position$1 < end ? src[position$1] : 0;
+				if (byte1 > 0xf4 || position$1 >= end || (byte2 & 0xc0) !== 0x80 ||
+					(byte1 === 0xf0 && byte2 < 0x90) || (byte1 === 0xf4 && byte2 >= 0x90)) {
+					units.push(0xFFFD);
 				} else {
-					units.push(unit);
+					position$1++;
+					if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+						units.push(0xFFFD);
+					} else {
+						const byte3 = src[position$1++] & 0x3f;
+						if (position$1 >= end || (src[position$1] & 0xc0) !== 0x80) {
+							units.push(0xFFFD);
+						} else {
+							const byte4 = src[position$1++] & 0x3f;
+							let unit = ((byte1 & 0x07) << 0x12) | ((byte2 & 0x3f) << 0x0c) | (byte3 << 0x06) | byte4;
+							unit -= 0x10000;
+							units.push(((unit >>> 10) & 0x3ff) | 0xd800);
+							units.push(0xdc00 | (unit & 0x3ff));
+						}
+					}
 				}
 			} else {
 				units.push(0xFFFD); // replacement character for invalid lead byte
@@ -1129,10 +1145,12 @@
 	}
 
 	function readJustLength() {
+		if (!(position$1 < srcEnd)) throw endOfCBORError()
 		let token = src[position$1++] & 0x1f;
 		if (token > 0x17) {
 			switch (token) {
 				case 0x18:
+					if (position$1 >= srcEnd) throw endOfCBORError()
 					token = src[position$1++];
 					break
 				case 0x19:
@@ -2462,7 +2480,7 @@
 			if (typeof require == 'function')
 				extractor = require('cbor-extract');
 			else
-				extractor = module.createRequire((document.currentScript && document.currentScript.src || new URL('test.js', document.baseURI).href))('cbor-extract');
+				extractor = module.createRequire((_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('test.js', document.baseURI).href))('cbor-extract');
 			if (extractor)
 				setExtractor(extractor.extractStrings);
 		} catch (error) {
@@ -2470,7 +2488,7 @@
 		}
 	}
 
-	const sampleData = JSON.parse(fs.readFileSync(new URL('./example4.json', (document.currentScript && document.currentScript.src || new URL('test.js', document.baseURI).href))));
+	const sampleData = JSON.parse(fs.readFileSync(new URL('./example4.json', (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('test.js', document.baseURI).href))));
 
 	const senmlData = [ 
 		{ bn: '/3303/0/5700', bt: 1278887, v: 35.5 },