msgpackr 1.10.0 → 1.10.1

package/dist/index-no-eval.cjs

@@ -859,7 +859,7 @@
 				return readFixedString(length)
 		} else { // not cacheable, go back and do a standard read
 			position$1--;
-			return read().toString()
+			return asSafeString(read())
 		}
 		let key = ((length << 5) ^ (length > 1 ? dataView.getUint16(position$1) : length > 0 ? src[position$1] : 0)) & 0xfff;
 		let entry = keyCache[key];
@@ -911,9 +911,15 @@
 		return entry.string = readFixedString(length)
 	}
 
+	function asSafeString(property) {
+		if (typeof property === 'string') return property;
+		if (typeof property === 'number') return property.toString();
+		throw new Error('Invalid property type for record', typeof property);
+	}
 	// the registration of the record definition extension (as "r")
 	const recordDefinition = (id, highByte) => {
-		let structure = read().map(property => property.toString()); // ensure that all keys are strings and that the array is mutable
+		let structure = read().map(asSafeString); // ensure that all keys are strings and
+		// that the array is mutable
 		let firstByte = id;
 		if (highByte !== undefined) {
 			id = id < 32 ? -((highByte << 5) + id) : ((highByte << 5) + id);
@@ -952,6 +958,7 @@
 
 	currentExtensions[0x69] = (data) => {
 		// id extension (for structured clones)
+		if (currentUnpackr.structuredClone === false) throw new Error('Structured clone extension is disabled')
 		let id = dataView.getUint32(position$1 - 4);
 		if (!referenceMap)
 			referenceMap = new Map();
@@ -975,6 +982,7 @@
 
 	currentExtensions[0x70] = (data) => {
 		// pointer extension (for structured clones)
+		if (currentUnpackr.structuredClone === false) throw new Error('Structured clone extension is disabled')
 		let id = dataView.getUint32(position$1 - 4);
 		let refEntry = referenceMap.get(id);
 		refEntry.used = true;