@dao-xyz/borsh - npm Package Compare versions

Comparing version 5.1.5 to 5.2.0

lib/cjs/binary.d.ts

 import { PrimitiveType, SmallIntegerType } from './types.js';
+export type Limits = {
+    limit?: {
+        stringLength: number;
+    };
+};
 export declare class BinaryWriter {
@@ -63,8 +68,8 @@ totalSize: number;
     static f64(reader: BinaryReader): number;
-    string(): string;
-    static string(reader: BinaryReader): string;
-    static bufferString(reader: BinaryReader): string;
-    static bufferStringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number): string;
-    static stringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number): string;
-    static read(encoding: PrimitiveType, fromBuffer?: boolean): ((reader: BinaryReader) => number) | ((reader: BinaryReader) => bigint) | ((reader: BinaryReader) => boolean) | ((reader: BinaryReader) => string);
+    string(limit?: Limits): string;
+    static string(reader: BinaryReader, options?: Limits): string;
+    static bufferString(reader: BinaryReader, options?: Limits): string;
+    static bufferStringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number, options?: Limits): string;
+    static stringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number, options?: Limits): string;
+    static read(encoding: PrimitiveType, fromBuffer?: boolean): ((reader: BinaryReader, limit?: Limits) => number) | ((reader: BinaryReader, limit?: Limits) => bigint) | ((reader: BinaryReader, limit?: Limits) => boolean) | ((reader: BinaryReader, limit?: Limits) => string);
     buffer(len: number): Uint8Array;
@@ -71,0 +76,0 @@ uint8Array(): Uint8Array;

lib/cjs/binary.js

@@ -333,7 +333,10 @@ "use strict";
     }
-    string() {
-        return BinaryReader.string(this);
+    string(limit) {
+        return BinaryReader.string(this, limit);
     }
-    static string(reader) {
+    static string(reader, options) {
         const len = reader.u32();
+        if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+            throw new error_js_1.BorshError(`Error decoding UTF-8 string: String will be longer than allowed`);
+        }
         try {
@@ -349,4 +352,7 @@ const end = reader._offset + len;
     }
-    static bufferString(reader) {
+    static bufferString(reader, options) {
         const len = reader.u32();
+        if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+            throw new error_js_1.BorshError(`Error decoding UTF-8 string: String will be longer than allowed`);
+        }
         const end = reader._offset + len;
@@ -357,4 +363,7 @@ const string = reader._buf.toString(undefined, reader._offset, end);
     }
-    static bufferStringCustom(reader, length) {
+    static bufferStringCustom(reader, length, options) {
         const len = length(reader);
+        if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+            throw new error_js_1.BorshError(`Error decoding UTF-8 string: String will be longer than allowed`);
+        }
         try {
@@ -370,4 +379,7 @@ const end = reader._offset + len;
     }
-    static stringCustom(reader, length) {
+    static stringCustom(reader, length, options) {
         const len = length(reader);
+        if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+            throw new error_js_1.BorshError(`Error decoding UTF-8 string: String will be longer than allowed`);
+        }
         try {
@@ -374,0 +386,0 @@ const end = reader._offset + len;

lib/cjs/index.d.ts

@@ -5,3 +5,3 @@ import { StructKind, SimpleField, CustomField, Constructor, AbstractType } from "./types.js";
 export * from './error.js';
-import { BinaryReader } from "./binary.js";
+import { BinaryReader, Limits } from "./binary.js";
 /**
@@ -25,3 +25,3 @@ * Serialize an object with @field(...) or @variant(...) decorators
     unchecked?: boolean;
-} & ({
+} & Limits & ({
     construct?: boolean;
@@ -28,0 +28,0 @@ } | {

lib/cjs/index.js

@@ -258,3 +258,3 @@ "use strict";
             const sizeReader = binary_js_1.BinaryReader.read(fieldType.sizeEncoding, fromBuffer);
-            return fromBuffer ? (reader) => binary_js_1.BinaryReader.bufferStringCustom(reader, sizeReader) : (reader) => binary_js_1.BinaryReader.stringCustom(reader, sizeReader);
+            return fromBuffer ? (reader, options) => binary_js_1.BinaryReader.bufferStringCustom(reader, sizeReader, options) : (reader, options) => binary_js_1.BinaryReader.stringCustom(reader, sizeReader, options);
         }
@@ -261,0 +261,0 @@ if (typeof fieldType["deserialize"] == "function") {

lib/esm/binary.d.ts

 import { PrimitiveType, SmallIntegerType } from './types.js';
+export type Limits = {
+    limit?: {
+        stringLength: number;
+    };
+};
 export declare class BinaryWriter {
@@ -63,8 +68,8 @@ totalSize: number;
     static f64(reader: BinaryReader): number;
-    string(): string;
-    static string(reader: BinaryReader): string;
-    static bufferString(reader: BinaryReader): string;
-    static bufferStringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number): string;
-    static stringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number): string;
-    static read(encoding: PrimitiveType, fromBuffer?: boolean): ((reader: BinaryReader) => number) | ((reader: BinaryReader) => bigint) | ((reader: BinaryReader) => boolean) | ((reader: BinaryReader) => string);
+    string(limit?: Limits): string;
+    static string(reader: BinaryReader, options?: Limits): string;
+    static bufferString(reader: BinaryReader, options?: Limits): string;
+    static bufferStringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number, options?: Limits): string;
+    static stringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number, options?: Limits): string;
+    static read(encoding: PrimitiveType, fromBuffer?: boolean): ((reader: BinaryReader, limit?: Limits) => number) | ((reader: BinaryReader, limit?: Limits) => bigint) | ((reader: BinaryReader, limit?: Limits) => boolean) | ((reader: BinaryReader, limit?: Limits) => string);
     buffer(len: number): Uint8Array;
@@ -71,0 +76,0 @@ uint8Array(): Uint8Array;

lib/esm/binary.js

@@ -326,7 +326,10 @@ import { toBigIntLE, writeBufferLEBigInt, writeUInt32LE, readUInt32LE, readUInt16LE, writeUInt16LE, readBigUInt64LE, readUIntLE, checkInt, writeBigUint64Le } from './bigint.js';
     }
-    string() {
-        return BinaryReader.string(this);
+    string(limit) {
+        return BinaryReader.string(this, limit);
     }
-    static string(reader) {
+    static string(reader, options) {
         const len = reader.u32();
+        if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+            throw new BorshError(`Error decoding UTF-8 string: String will be longer than allowed`);
+        }
         try {
@@ -342,4 +345,7 @@ const end = reader._offset + len;
     }
-    static bufferString(reader) {
+    static bufferString(reader, options) {
         const len = reader.u32();
+        if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+            throw new BorshError(`Error decoding UTF-8 string: String will be longer than allowed`);
+        }
         const end = reader._offset + len;
@@ -350,4 +356,7 @@ const string = reader._buf.toString(undefined, reader._offset, end);
     }
-    static bufferStringCustom(reader, length) {
+    static bufferStringCustom(reader, length, options) {
         const len = length(reader);
+        if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+            throw new BorshError(`Error decoding UTF-8 string: String will be longer than allowed`);
+        }
         try {
@@ -363,4 +372,7 @@ const end = reader._offset + len;
     }
-    static stringCustom(reader, length) {
+    static stringCustom(reader, length, options) {
         const len = length(reader);
+        if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+            throw new BorshError(`Error decoding UTF-8 string: String will be longer than allowed`);
+        }
         try {
@@ -367,0 +379,0 @@ const end = reader._offset + len;

lib/esm/index.d.ts

@@ -5,3 +5,3 @@ import { StructKind, SimpleField, CustomField, Constructor, AbstractType } from "./types.js";
 export * from './error.js';
-import { BinaryReader } from "./binary.js";
+import { BinaryReader, Limits } from "./binary.js";
 /**
@@ -25,3 +25,3 @@ * Serialize an object with @field(...) or @variant(...) decorators
     unchecked?: boolean;
-} & ({
+} & Limits & ({
     construct?: boolean;
@@ -28,0 +28,0 @@ } | {

lib/esm/index.js

@@ -239,3 +239,3 @@ import { FixedArrayKind, OptionKind, StructKind, VecKind, getOffset, StringType, } from "./types.js";
             const sizeReader = BinaryReader.read(fieldType.sizeEncoding, fromBuffer);
-            return fromBuffer ? (reader) => BinaryReader.bufferStringCustom(reader, sizeReader) : (reader) => BinaryReader.stringCustom(reader, sizeReader);
+            return fromBuffer ? (reader, options) => BinaryReader.bufferStringCustom(reader, sizeReader, options) : (reader, options) => BinaryReader.stringCustom(reader, sizeReader, options);
         }
@@ -242,0 +242,0 @@ if (typeof fieldType["deserialize"] == "function") {

package.json

 {
   "name": "@dao-xyz/borsh",
-  "version": "5.1.5",
+  "version": "5.2.0",
   "readme": "README.md",
@@ -5,0 +5,0 @@ "homepage": "https://github.com/dao-xyz/borsh-ts#README",

src/__tests__/index.test.ts

@@ -1522,2 +1522,56 @@ import { BinaryReader, BinaryWriter } from "../binary.js";
   });
+
+  test("string max length", () => {
+    class TestStruct {
+      @field({ type: "string" })
+      string: string;
+
+      constructor(string: string) {
+        this.string = string;
+      }
+    }
+    expect(
+      deserialize(serialize(new TestStruct("abc")), TestStruct, {
+        limit: { stringLength: 3 },
+      }).string
+    ).toEqual("abc");
+
+    expect(
+      () =>
+        deserialize(serialize(new TestStruct("abc")), TestStruct, {
+          limit: { stringLength: 2 },
+        }).string
+    ).toThrowError(
+      new BorshError(
+        "Error decoding UTF-8 string: String will be longer than allowed"
+      )
+    );
+  });
+
+  test("string custom length", () => {
+    class TestStruct {
+      @field({ type: string("u16") })
+      string: string;
+
+      constructor(string: string) {
+        this.string = string;
+      }
+    }
+    expect(
+      deserialize(serialize(new TestStruct("abc")), TestStruct, {
+        limit: { stringLength: 3 },
+      }).string
+    ).toEqual("abc");
+
+    expect(
+      () =>
+        deserialize(serialize(new TestStruct("abc")), TestStruct, {
+          limit: { stringLength: 2 },
+        }).string
+    ).toThrowError(
+      new BorshError(
+        "Error decoding UTF-8 string: String will be longer than allowed"
+      )
+    );
+  });
 });
@@ -1524,0 +1578,0 @@

src/binary.ts

@@ -7,2 +7,7 @@ import { toBigIntLE, writeBufferLEBigInt, writeUInt32LE, readUInt32LE, readUInt16LE, writeUInt16LE, readBigUInt64LE, readUIntLE, checkInt, writeBigUint64Le } from './bigint.js';
 
+export type Limits = {
+  limit?: {
+    stringLength: number
+  }
+}
 const allocUnsafeFn = (): (len: number) => Uint8Array => {
@@ -417,8 +422,11 @@ if ((globalThis as any).Buffer) {
 
-  string(): string {
-    return BinaryReader.string(this);
+  string(limit?: Limits): string {
+    return BinaryReader.string(this, limit);
   }
 
-  static string(reader: BinaryReader): string {
+  static string(reader: BinaryReader, options?: Limits): string {
     const len = reader.u32();
+    if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+      throw new BorshError(`Error decoding UTF-8 string: String will be longer than allowed`)
+    }
     try {
@@ -434,4 +442,7 @@ const end = reader._offset + len;
 
-  static bufferString(reader: BinaryReader): string {
+  static bufferString(reader: BinaryReader, options?: Limits): string {
     const len = reader.u32();
+    if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+      throw new BorshError(`Error decoding UTF-8 string: String will be longer than allowed`)
+    }
     const end = reader._offset + len;
@@ -444,4 +455,7 @@ const string = (reader._buf as Buffer).toString(undefined, reader._offset, end);
 
-  static bufferStringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number): string {
+  static bufferStringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number, options?: Limits): string {
     const len = length(reader);
+    if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+      throw new BorshError(`Error decoding UTF-8 string: String will be longer than allowed`)
+    }
     try {
@@ -457,4 +471,7 @@ const end = reader._offset + len;
 
-  static stringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number): string {
+  static stringCustom(reader: BinaryReader, length: (reader: BinaryReader) => number, options?: Limits): string {
     const len = length(reader);
+    if (options?.limit?.stringLength != null && len > options?.limit?.stringLength) {
+      throw new BorshError(`Error decoding UTF-8 string: String will be longer than allowed`)
+    }
     try {
@@ -470,3 +487,3 @@ const end = reader._offset + len;
 
-  public static read(encoding: PrimitiveType, fromBuffer?: boolean): ((reader: BinaryReader) => number) | ((reader: BinaryReader) => bigint) | ((reader: BinaryReader) => boolean) | ((reader: BinaryReader) => string) {
+  public static read(encoding: PrimitiveType, fromBuffer?: boolean): ((reader: BinaryReader, limit?: Limits) => number) | ((reader: BinaryReader, limit?: Limits) => bigint) | ((reader: BinaryReader, limit?: Limits) => boolean) | ((reader: BinaryReader, limit?: Limits) => string) {
     if (encoding === 'u8') {
@@ -473,0 +490,0 @@ return BinaryReader.u8

src/index.ts

@@ -19,3 +19,3 @@ import {
 import { BorshError } from "./error.js";
-import { BinaryWriter, BinaryReader } from "./binary.js";
+import { BinaryWriter, BinaryReader, Limits } from "./binary.js";
 
@@ -62,3 +62,3 @@ /**
   unchecked?: boolean
-} & ({ construct?: boolean } | { object?: boolean });
+} & Limits & ({ construct?: boolean } | { object?: boolean });
 export function deserialize<T>(
@@ -319,3 +319,3 @@ buffer: Uint8Array,
 
-      return fromBuffer ? (reader) => BinaryReader.bufferStringCustom(reader, sizeReader) : (reader) => BinaryReader.stringCustom(reader, sizeReader)
+      return fromBuffer ? (reader, options) => BinaryReader.bufferStringCustom(reader, sizeReader, options) : (reader, options) => BinaryReader.stringCustom(reader, sizeReader, options)
     }
@@ -477,3 +477,3 @@
         let agg: number[] = [];
-        for (let i = 0; i < variantType; i++) {
+        for (let i = 0; i < (variantType as number); i++) {
           agg.push(reader.u8())
@@ -805,3 +805,3 @@ }
           // Validate field
-          validateIterator(field.type, allowUndefined, visited);
+          validateIterator(field.type as Constructor<any> | Constructor<any>[], allowUndefined, visited);
         }
@@ -808,0 +808,0 @@ });

New alerts

Deprecated

Maintenance

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

360607

increased by1.69%

Lines of code

6643

increased by1.51%

Worsened metrics

Number of medium maintenance alerts

1

increased byInfinity%

No dependency changes