mirrors/bun.sh
1
0
Fork 0
mirror of https://github.com/oven-sh/bun synced 2026-02-09 10:28:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix assertion failure in Bun.escapeHTML with latin1 input (#12185)

Browse Source
This commit is contained in:
Jarred Sumner
2024-06-26 18:25:02 -07:00
committed by GitHub
parent 10ce5ddd24
commit 60ef13e079
2 changed files with 25 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/string_immutable.zig
View File

@@ -2570,8 +2570,7 @@ pub fn escapeHTMLForLatin1Input(allocator: std.mem.Allocator, latin1: []const u8
buf = try std.ArrayList(u8).initCapacity(allocator, latin1.len + 6);
const copy_len = @intFromPtr(remaining.ptr) - @intFromPtr(latin1.ptr);
@memcpy(buf.items[0..copy_len], latin1[0..copy_len]);
buf.items.len = copy_len;
buf.appendSliceAssumeCapacity(latin1[0..copy_len]);
any_needs_escape = true;
inline for (0..ascii_vector_size) |i| {
switch (vec[i]) {

24
test/js/bun/util/escapeHTML.test.js
View File

@@ -102,4 +102,28 @@ describe("escapeHTML", () => {
escapeHTML(String.fromCodePoint(0xd800) + "\xff".repeat(i));
}
});
it("fuzz latin1", () => {
for (let i = 0; i < 256; i++) {
const initial = Buffer.alloc(i + 1, "a");
for (let j = 0; j < i; j++) {
const clone = Buffer.from(initial);
clone[j] = ">".charCodeAt(0);
Bun.escapeHTML(clone.toString());
}
}
});
it("fuzz utf16", () => {
for (let i = 0; i < 256; i++) {
const initial = new Uint16Array(i);
initial.fill("a".charCodeAt(0));
for (let j = 0; j < i; j++) {
const clone = Buffer.from(initial);
clone[j] = ">".charCodeAt(0);
Bun.escapeHTML(clone.toString("utf16le"));
}
}
});
});