Closed broofa closed 2 years ago
Hi @broofa,
I understand where you are coming from. Many JavaScript libraries use ducktyping to "verify" that the input is of a specific type.
Note that normal users don't have to interact with this library. I see lib0 more as an expert library, and I expect users who consume this library directly to use typescript, which would easily catch an issue like this.
Ducktyping complicates the codebase and, personally, I don't see it as a good practice in JavaScript libraries. However, I see that expectations differ as a majority of npm packages still use ducktyping instead of adding proper type information.
So we are able to reproduce this easily (see below), based on a unit test we have for invalid input to a Y.Doc:
const Y = require('yjs')
const tempYdoc = new Y.Doc();
const ydocBytes = Buffer.from("garbage", "base64");
Y.applyUpdate(tempYdoc, ydocBytes);
// Hangs forever
Note that normal users don't have to interact with this library. I see lib0 more as an expert library, and I expect users who consume this library directly to use typescript, which would easily catch an issue like this.
@dmonad Do you have a recommendation for how to validate input to applyUpdate
before passing it in?
Here's some sample code I have trying to validate a good update from a bad one:
const JSBase64 = require("js-base64");
const Y = require("yjs");
const lib0 = require("lib0");
const sampleYdoc = new Y.Doc();
sampleYdoc.getArray("myarray").insert(0, ["Hello doc2, you got this?"]);
const sampleYdocState = Y.encodeStateAsUpdate(sampleYdoc); // is a Uint8Array
const sampleYdocString = JSBase64.fromUint8Array(sampleYdocState);
const updateGood = Buffer.from(sampleYdocString, "base64");
const updateBad = Buffer.from("garbagedoc", "base64");
const decoderGood = lib0.decoding.createDecoder(updateGood);
const decoderBad = lib0.decoding.createDecoder(updateBad);
// How can I verify that updateBad is in fact bad?
Describe the bug The following code loops forever due to
r
being undefined insidereadVarUint()
.Expected behavior createDecoder() should throw if passed an unexpected value (such as a Blob)
... or something, anything, other than locking up the CPU/browser/system for all eternity. :-)
Screenshots![CleanShot 2022-08-19 at 15 02 14@2x](https://user-images.githubusercontent.com/164050/185712974-28361503-5d79-44f3-b0d5-63d4646c5e11.png)