@dfinity/agent - npm Package Compare versions

Comparing version 0.6.4 to 0.6.5

package.json

 {
   "name": "@dfinity/agent",
-  "version": "0.6.4",
+  "version": "0.6.5",
   "main": "src/index.js",
@@ -5,0 +5,0 @@ "scripts": {

src/idl.js

@@ -633,5 +633,8 @@ "use strict";
         }
-        else {
+        else if (len === '01') {
             return [this._type.decodeValue(b, opt._type)];
         }
+        else {
+            throw new Error('Not an option value');
+        }
     }
@@ -767,3 +770,13 @@ get name() {
         }
-        return this._components.map((c, i) => c.decodeValue(b, tuple._components[i]));
+        const res = [];
+        for (const [i, wireType] of tuple._components.entries()) {
+            if (i >= this._components.length) {
+                // skip value
+                wireType.decodeValue(b, wireType);
+            }
+            else {
+                res.push(this._components[i].decodeValue(b, wireType));
+            }
+        }
+        return res;
     }
@@ -1017,3 +1030,7 @@ display() {
         const mLen = leb128_1.lebDecode(b).toNumber();
-        const method = leb128_1.safeRead(b, mLen).toString('utf8');
+        const buf = leb128_1.safeRead(b, mLen);
+        if (!isValidUTF8(buf)) {
+            throw new Error('Not valid UTF8 method name');
+        }
+        const method = buf.toString('utf8');
         return [canister, method];
@@ -1133,7 +1150,3 @@ }
             switch (ty) {
-                case -18 /* Opt */: {
-                    const t = leb128_1.slebDecode(pipe).toNumber();
-                    typeTable.push([ty, t]);
-                    break;
-                }
+                case -18 /* Opt */:
                 case -19 /* Vector */: {
@@ -1144,7 +1157,16 @@ const t = leb128_1.slebDecode(pipe).toNumber();
                 }
-                case -20 /* Record */: {
+                case -20 /* Record */:
+                case -21 /* Variant */: {
                     const fields = [];
                     let objectLength = leb128_1.lebDecode(pipe).toNumber();
+                    let prevHash;
                     while (objectLength--) {
                         const hash = leb128_1.lebDecode(pipe).toNumber();
+                        if (hash >= Math.pow(2, 32)) {
+                            throw new Error('field id out of 32-bit range');
+                        }
+                        if (typeof prevHash === 'number' && prevHash >= hash) {
+                            throw new Error('field id collision or not sorted');
+                        }
+                        prevHash = hash;
                         const t = leb128_1.slebDecode(pipe).toNumber();
@@ -1156,13 +1178,2 @@ fields.push([hash, t]);
                 }
-                case -21 /* Variant */: {
-                    const fields = [];
-                    let variantLength = leb128_1.lebDecode(pipe).toNumber();
-                    while (variantLength--) {
-                        const hash = leb128_1.lebDecode(pipe).toNumber();
-                        const t = leb128_1.slebDecode(pipe).toNumber();
-                        fields.push([hash, t]);
-                    }
-                    typeTable.push([ty, fields]);
-                    break;
-                }
                 case -22 /* Func */: {
@@ -1169,0 +1180,0 @@ for (let k = 0; k < 2; k++) {

New alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

147945

increased by0.2%

Lines of code

4242

increased by0.26%

Worsened metrics

Number of medium supply chain risk alerts

2

increased by100%

No dependency changes