fix: don't DOS on nth key (#305)

flightcontrolhq · Dec 5, 2024 · 5debdda · 5debdda
1 parent 4e670bd
commit 5debdda
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/src/accessDeep.ts b/src/accessDeep.ts
@@ -2,6 +2,7 @@ import { isMap, isArray, isPlainObject, isSet } from './is.js';
 import { includes } from './util.js';
 
 const getNthKey = (value: Map<any, any> | Set<any>, n: number): any => {
+  if (n > value.size) throw new Error('index out of bounds');
   const keys = value.keys();
   while (n > 0) {
     keys.next();

diff --git a/src/index.test.ts b/src/index.test.ts
@@ -1229,3 +1229,15 @@ test('dedupe=true on a large complicated schema', () => {
   expect(nondedupedOut).toEqual(deserialized);
   expect(dedupedOut).toEqual(deserialized);
 });
+
+test('doesnt iterate to keys that dont exist', () => {
+  const robbyBubble = { id: 5 };
+  const highscores = new Map([[robbyBubble, 5000]]);
+  const objectWithReferentialEquality = { highscores, topScorer: robbyBubble };
+  const res = SuperJSON.serialize(objectWithReferentialEquality);
+
+  expect(res.meta.referentialEqualities.topScorer).toEqual(['highscores.0.0']);
+  res.meta.referentialEqualities.topScorer = ['highscores.99999.0'];
+
+  expect(() => SuperJSON.deserialize(res)).toThrowError('index out of bounds');
+});