msgpackr 1.11.8 → 1.11.10

package/README.md

@@ -7,8 +7,6 @@
 [![module](https://img.shields.io/badge/module-ESM%2FCJS-blue)](README.md)
 [![license](https://img.shields.io/badge/license-MIT-brightgreen)](LICENSE)
 
-<img align="right" src="./assets/performance.png" width="380"/>
-
 The msgpackr package is an extremely fast MessagePack NodeJS/JavaScript implementation. Currently, it is significantly faster than any other known implementations, faster than Avro (for JS), and generally faster than native V8 JSON.stringify/parse, on NodeJS. It also includes an optional record extension (the `r` in msgpackr), for defining record structures that makes MessagePack even faster and more compact, often over twice as fast as even native JSON functions, several times faster than other JS implementations, and 15-50% more compact. See the performance section for more details. Structured cloning (with support for cyclical references) is also supported through optional extensions.
 
 ## Basic Usage

package/benchmark.md

@@ -1,24 +1,34 @@
 Here are more comprehensive benchmarks. This is comparison with the next fastest JS projects using the benchmark tool from `msgpack-lite` (and data is from some clinical research data we use that has a good mix of different value types and structures). It also includes comparison to V8 native JSON functionality, and JavaScript Avro (`avsc`, a very optimized Avro implementation):
 
-operation                                                  |   op   |   ms  |  op/s
----------------------------------------------------------- | ------: | ----: | -----:
-buf = Buffer(JSON.stringify(obj));                         |   82000 |  5004 |  16386
-obj = JSON.parse(buf);                                     |   88600 |  5000 |  17720
-require("msgpackr").pack(obj);                             |  161500 |  5002 |  32287
-require("msgpackr").unpack(buf);                           |   94600 |  5004 |  18904
-msgpackr w/ shared structures: packr.pack(obj);            |  178400 |  5002 |  35665
-msgpackr w/ shared structures: packr.unpack(buf);          |  376700 |  5000 |  75340
-buf = require("msgpack-lite").encode(obj);                 |   30100 |  5012 |   6005
-obj = require("msgpack-lite").decode(buf);                 |   16200 |  5001 |   3239
-buf = require("notepack").encode(obj);                     |   62600 |  5005 |  12507
-obj = require("notepack").decode(buf);                     |   32400 |  5007 |   6470
-require("what-the-pack")... encoder.encode(obj);           |   63500 |  5002 |  12694
-require("what-the-pack")... encoder.decode(buf);           |   32000 |  5001 |   6398
-require("avsc")...make schema/type...type.toBuffer(obj);   |   84600 |  5003 |  16909
-require("avsc")...make schema/type...type.toBuffer(obj);   |   99300 |  5001 |  19856
+---------------------------------------------------------- | ------: | ----: | -----: | -----:
+msgpackr w/ shared structures: packr.pack(obj);            |  254700 |  5001 |  50929
+msgpackr w/ shared structures: packr.unpack(buf);          |  711700 |  5000 | 142340
+require("msgpackr").pack(obj);                             |  234000 |  5000 |  46800
+require("msgpackr").unpack(buf);                           |  186500 |  5000 |  37300
+buf = Buffer(JSON.stringify(obj));                         |  297900 |  5000 |  59580
+obj = JSON.parse(buf);                                     |  216600 |  5001 |  43311
+buf = require("msgpack-lite").encode(obj);                 |  114000 |  5001 |  22795
+obj = require("msgpack-lite").decode(buf);                 |   40700 |  5006 |   8130
+buf = require("@msgpack/msgpack").encode(obj);             |  166100 |  5000 |  33220
+obj = require("@msgpack/msgpack").decode(buf);             |  136500 |  5002 |  27289
+buf = require("msgpack-js-v5").encode(obj);                |   41600 |  5000 |   8320
+obj = require("msgpack-js-v5").decode(buf);                |   70200 |  5004 |  14028
+buf = require("msgpack-js").encode(obj);                   |   40400 |  5012 |   8060
+obj = require("msgpack-js").decode(buf);                   |   67100 |  5002 |  13414
+buf = require("msgpack5")().encode(obj);                   |   15800 |  5024 |   3144
+obj = require("msgpack5")().decode(buf);                   |   30600 |  5004 |   6115
+buf = require("notepack").encode(obj);                     |  125100 |  5002 |  25009
+obj = require("notepack").decode(buf);                     |   98600 |  5004 |  19704
+require("what-the-pack")... encoder.encode(obj);           |  150300 |  5001 |  30053
+require("what-the-pack")... encoder.decode(buf);           |  100100 |  5000 |  20020
+obj = require("msgpack-unpack").decode(buf);               |   14900 |  5031 |   2961
+require("avsc")...make schema/type...type.toBuffer(obj);   |  266600 |  5000 |  53320
+require("avsc")...make schema/type...type.fromBuffer(obj); |  370200 |  5000 |  74040
 
 (`avsc` is schema-based and more comparable in style to msgpackr with shared structures).
 
+(note that benchmarks below are several years old)
+
 Here is a benchmark of streaming data (again borrowed from `msgpack-lite`'s benchmarking), where msgpackr is able to take advantage of the structured record extension and really pull away from other tools:
 
 operation (1000000 x 2)                          |   op    |  ms   |  op/s

package/dist/index-no-eval.cjs

@@ -31,13 +31,6 @@
 	var inlineObjectReadThreshold = 2;
 	var readStruct;
 	var BlockedFunction; // we use search and replace to change the next call to BlockedFunction to avoid CSP issues for
-	// no-eval build
-	try {
-		new BlockedFunction ('');
-	} catch(error) {
-		// if eval variants are not supported, do not create inline object readers ever
-		inlineObjectReadThreshold = Infinity;
-	}
 
 	class Unpackr {
 		constructor(options) {
@@ -503,11 +496,18 @@
 		function readObject() {
 			// This initial function is quick to instantiate, but runs slower. After several iterations pay the cost to build the faster function
 			if (readObject.count++ > inlineObjectReadThreshold) {
-				let readObject = structure.read = (new BlockedFunction ('r', 'return function(){return ' + (currentUnpackr.freezeData ? 'Object.freeze' : '') +
-					'({' + structure.map(key => key === '__proto__' ? '__proto_:r()' : validName.test(key) ? key + ':r()' : ('[' + JSON.stringify(key) + ']:r()')).join(',') + '})}'))(read);
+				let optimizedReadObject;
+				try {
+					optimizedReadObject = structure.read = (new BlockedFunction ('r', 'return function(){return ' + (currentUnpackr.freezeData ? 'Object.freeze' : '') +
+						'({' + structure.map(key => key === '__proto__' ? '__proto_:r()' : validName.test(key) ? key + ':r()' : ('[' + JSON.stringify(key) + ']:r()')).join(',') + '})}'))(read);
+				} catch(error) {
+					// in CF workers, the new BlockedFunction  call could begin to fail at any point in time
+					inlineObjectReadThreshold = Infinity; // disable going forward
+					return readObject(); // recursively try again
+				}
 				if (structure.highByte === 0)
 					structure.read = createSecondByteReader(firstId, structure.read);
-				return readObject() // second byte is already read, if there is one so immediately read object
+				return optimizedReadObject() // second byte is already read, if there is one so immediately read object
 			}
 			let object = {};
 			for (let i = 0, l = structure.length; i < l; i++) {
@@ -576,26 +576,45 @@
 			} else if ((byte1 & 0xe0) === 0xc0) {
 				// 2 bytes
 				const byte2 = src[position$1++] & 0x3f;
-				units.push(((byte1 & 0x1f) << 6) | byte2);
+				const codePoint = ((byte1 & 0x1f) << 6) | byte2;
+				// Reject overlong encoding: 2-byte sequences must encode values >= 0x80
+				if (codePoint < 0x80) {
+					units.push(0xFFFD); // replacement character
+				} else {
+					units.push(codePoint);
+				}
 			} else if ((byte1 & 0xf0) === 0xe0) {
 				// 3 bytes
 				const byte2 = src[position$1++] & 0x3f;
 				const byte3 = src[position$1++] & 0x3f;
-				units.push(((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3);
+				const codePoint = ((byte1 & 0x1f) << 12) | (byte2 << 6) | byte3;
+				// Reject overlong encoding: 3-byte sequences must encode values >= 0x800
+				// Also reject surrogates (0xD800-0xDFFF)
+				if (codePoint < 0x800 || (codePoint >= 0xD800 && codePoint <= 0xDFFF)) {
+					units.push(0xFFFD); // replacement character
+				} else {
+					units.push(codePoint);
+				}
 			} else if ((byte1 & 0xf8) === 0xf0) {
 				// 4 bytes
 				const byte2 = src[position$1++] & 0x3f;
 				const byte3 = src[position$1++] & 0x3f;
 				const byte4 = src[position$1++] & 0x3f;
 				let unit = ((byte1 & 0x07) << 0x12) | (byte2 << 0x0c) | (byte3 << 0x06) | byte4;
-				if (unit > 0xffff) {
+				// Reject overlong encoding: 4-byte sequences must encode values >= 0x10000
+				// Also reject values > 0x10FFFF (maximum valid Unicode)
+				if (unit < 0x10000 || unit > 0x10FFFF) {
+					units.push(0xFFFD); // replacement character
+				} else if (unit > 0xffff) {
 					unit -= 0x10000;
 					units.push(((unit >>> 10) & 0x3ff) | 0xd800);
 					unit = 0xdc00 | (unit & 0x3ff);
+					units.push(unit);
+				} else {
+					units.push(unit);
 				}
-				units.push(unit);
 			} else {
-				units.push(byte1);
+				units.push(0xFFFD); // replacement character for invalid lead byte
 			}
 
 			if (units.length >= 0x1000) {