denoland / rusty_v8

Rust bindings for the V8 JavaScript engine
https://crates.io/crates/v8
MIT License
3.13k stars 300 forks source link

`ExternalOneByteStringResource::as_str` is unsound #1531

Closed aapoalas closed 1 month ago

aapoalas commented 1 month ago

The method https://github.com/denoland/rusty_v8/blob/main/src/string.rs#L153-L168 converts to a Rust &str without checking the validity of the data because "The data is guaranteed to be ASCII."

But both https://github.com/denoland/rusty_v8/blob/main/src/string.rs#L582-L596 and https://github.com/denoland/rusty_v8/blob/main/src/string.rs#L627-L643 are documented as accepting Latin-1 characters.

A UTF-8 string borrowed from a ExternalOneByteStringResource may thus not actually be valid UTF-8.