search

digitalbazaar / vpqr

Takes a Verifiable Presentation, compresses it via CBOR-LD, and turns it into a QR Code. For Node.js and browser.
BSD 3-Clause "New" or "Revised" License
8 stars 2 forks source link

Potential ArrayBuffer woes #2

Closed dlongley closed 3 years ago

dlongley commented 3 years ago

The base32 library we're using (https://www.npmjs.com/package/base32-encode) takes an ArrayBuffer as input instead of a view like Uint8Array. This can be problematic if the Uint8Array generated as cborldBytes is a view on an ArrayBuffer that has a different length than the Uint8Array. For example, imagine an ArrayBuffer that is 8 KiB and the Uint8Array is only 100 bytes somewhere in the middle of that buffer.

To address this, we should add code to compare the length of the Uint8Array to its underlying buffer before passing the underlying buffer to the encode function. If the lengths are different, we need to create a new ArrayBuffer with a matching length and copy the data from the Uint8Array into it.

Alternatively, we should talk with the author of the lib and see what should be done about this potential problem; perhaps their intent was to just allow any TypedArray to be passed in -- and we could get their docs updated or something. The code, as-is, would accept a Uint8Array directly without issue.

LinusU commented 3 years ago

base32-encode version 1.2.0 now accepts Uint8Array as input 🚀

dlongley commented 3 years ago

@LinusU, thank you!

@dmitrizagidulin, closing this -- we just need to update our package.json file to require version 1.2.0.