Commit c6d8503
buffer: fix atob input validation
This commit fixes a few inconsistencies between Node.js `atob`
implementation and the WHATWG spec.
Refs: https://infra.spec.whatwg.org/#forgiving-base64-decode
Fixes: #42646
PR-URL: #42662
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: Akhil Marsonya <akhil.marsonya27@gmail.com>1 parent 567b96a commit c6d8503
2 files changed
Lines changed: 44 additions & 4 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -26,7 +26,7 @@ const { | |||
| 26 | 26 | ArrayFrom, | |
| 27 | 27 | ArrayIsArray, | |
| 28 | 28 | ArrayPrototypeForEach, | |
| 29 | - ArrayPrototypeIncludes, | ||
| 29 | + ArrayPrototypeIndexOf, | ||
| 30 | 30 | MathFloor, | |
| 31 | 31 | MathMin, | |
| 32 | 32 | MathTrunc, | |
@@ -1260,12 +1260,31 @@ function atob(input) { | |||
| 1260 | 1260 | if (arguments.length === 0) { | |
| 1261 | 1261 | throw new ERR_MISSING_ARGS('input'); | |
| 1262 | 1262 | } | |
| 1263 | + | ||
| 1263 | 1264 | input = `${input}`; | |
| 1265 | + let nonAsciiWhitespaceCharCount = 0; | ||
| 1266 | + | ||
| 1264 | 1267 | for (let n = 0; n < input.length; n++) { | |
| 1265 | - if (!ArrayPrototypeIncludes(kForgivingBase64AllowedChars, | ||
| 1266 | - StringPrototypeCharCodeAt(input, n))) | ||
| 1268 | + const index = ArrayPrototypeIndexOf( | ||
| 1269 | + kForgivingBase64AllowedChars, | ||
| 1270 | + StringPrototypeCharCodeAt(input, n)); | ||
| 1271 | + | ||
| 1272 | + if (index > 4) { | ||
| 1273 | + // The first 5 elements of `kForgivingBase64AllowedChars` are | ||
| 1274 | + // ASCII whitespace char codes. | ||
| 1275 | + nonAsciiWhitespaceCharCount++; | ||
| 1276 | + } else if (index === -1) { | ||
| 1267 | 1277 | throw lazyDOMException('Invalid character', 'InvalidCharacterError'); | |
| 1278 | + } | ||
| 1268 | 1279 | } | |
| 1280 | + | ||
| 1281 | + // See #3 - https://infra.spec.whatwg.org/#forgiving-base64 | ||
| 1282 | + if (nonAsciiWhitespaceCharCount % 4 === 1) { | ||
| 1283 | + throw lazyDOMException( | ||
| 1284 | + 'The string to be decoded is not correctly encoded.', | ||
| 1285 | + 'InvalidCharacterError'); | ||
| 1286 | + } | ||
| 1287 | + | ||
| 1269 | 1288 | return Buffer.from(input, 'base64').toString('latin1'); | |
| 1270 | 1289 | } | |
| 1271 | 1290 | ||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -14,4 +14,25 @@ throws(() => buffer.atob(), /TypeError/); | |||
| 14 | 14 | throws(() => buffer.btoa(), /TypeError/); | |
| 15 | 15 | ||
| 16 | 16 | strictEqual(atob(' '), ''); | |
| 17 | - strictEqual(atob(' YW\tJ\njZA=\r= '), 'abcd'); | ||
| 17 | + strictEqual(atob(' Y\fW\tJ\njZ A=\r= '), 'abcd'); | ||
| 18 | + | ||
| 19 | + strictEqual(atob(null), '\x9Eée'); | ||
| 20 | + strictEqual(atob(NaN), '5£'); | ||
| 21 | + strictEqual(atob(Infinity), '"wâ\x9E+r'); | ||
| 22 | + strictEqual(atob(true), '¶»\x9E'); | ||
| 23 | + strictEqual(atob(1234), '×mø'); | ||
| 24 | + strictEqual(atob([]), ''); | ||
| 25 | + strictEqual(atob({ toString: () => '' }), ''); | ||
| 26 | + strictEqual(atob({ [Symbol.toPrimitive]: () => '' }), ''); | ||
| 27 | + | ||
| 28 | + throws(() => atob(Symbol()), /TypeError/); | ||
| 29 | + [ | ||
| 30 | + undefined, false, () => {}, {}, [1], | ||
| 31 | + 0, 1, 0n, 1n, -Infinity, | ||
| 32 | + 'a', 'a\n\n\n', '\ra\r\r', ' a ', '\t\t\ta', 'a\f\f\f', '\ta\r \n\f', | ||
| 33 | + ].forEach((value) => | ||
| 34 | + // See #2 - https://html.spec.whatwg.org/multipage/webappapis.html#dom-atob | ||
| 35 | + throws(() => atob(value), { | ||
| 36 | + name: 'InvalidCharacterError', | ||
| 37 | + code: 5, | ||
| 38 | + })); | ||
0 commit comments