Compare commits

...

3 Commits

Author SHA1 Message Date
Claude Bot
f0e7ce0b6c Remove unnecessary intermediate variable in test 2025-10-22 08:14:28 +00:00
Claude Bot
f264f038a4 Address code review: combine duplicate expect assertions into single check 2025-10-22 08:09:45 +00:00
Claude Bot
bfff1d9350 Fix null pointer dereference in CookieMap.delete() with invalid constructor args
When CookieMap was constructed with invalid arguments and then delete() was
called with the CookieMap instance itself, it caused a null pointer dereference.

The issue was in jsCookieMapPrototypeFunction_deleteBody where
getIfPropertyExists() was called but the return value wasn't properly checked
before being used. getIfPropertyExists() returns an empty JSValue when the
property doesn't exist, and this empty value was being assigned directly.

The fix checks if the returned JSValue is valid before assigning it to
nameValue, matching the pattern already used for domain and path extraction.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-10-22 07:50:13 +00:00
2 changed files with 13 additions and 2 deletions

View File

@@ -455,8 +455,12 @@ static inline JSC::EncodedJSValue jsCookieMapPrototypeFunction_deleteBody(JSC::J
auto* options = optionsArg.getObject();
// Extract name
if (nameValue.isUndefined()) nameValue = options->getIfPropertyExists(lexicalGlobalObject, PropertyName(vm.propertyNames->name));
RETURN_IF_EXCEPTION(throwScope, {});
if (nameValue.isUndefined()) {
auto nameValueFromOptions = options->getIfPropertyExists(lexicalGlobalObject, PropertyName(vm.propertyNames->name));
RETURN_IF_EXCEPTION(throwScope, {});
if (nameValueFromOptions)
nameValue = nameValueFromOptions;
}
// Extract optional domain
auto domainValue = options->getIfPropertyExists(lexicalGlobalObject, names.domainPublicName());

View File

@@ -330,4 +330,11 @@ describe("iterator", () => {
a=b"
`);
});
test("delete with invalid constructor args should not crash", () => {
// Regression test for null pointer deref when calling delete with invalid args
const cookieMap = new Bun.CookieMap(Bun.CookieMap, Bun.CookieMap, Bun, Bun.CookieMap);
// Should throw TypeError instead of crashing with null pointer dereference
expect(() => cookieMap.delete(cookieMap)).toThrow(new TypeError("Cookie name is required"));
});
});