endojs / endo

Endo is a distributed secure JavaScript sandbox, based on SES
Apache License 2.0
761 stars 68 forks source link

atob() return is not limited to ASCII #2315

Open dckc opened 3 weeks ago

dckc commented 3 weeks ago

Docs say it returns ASCII:

https://github.com/endojs/endo/blob/f84566506accf11ee11ba05404a5b161c25708d3/packages/base64/atob.js#L5

not so:

test('really ascii?', t => {
  const data = new Uint8Array([0x6e, 0xf1]);
  const encoded = encodeBase64(data);
  const actual = atob(encoded);
  const ascii = /^[\x20-\x7f]+$/;
  t.log(actual);
  t.regex(actual, ascii);
});
kriskowal commented 3 weeks ago

Aye, this should be revised to “string where each character’s code point is the value of the corresponding byte in the range 0 to 255” or words to that effect.

https://developer.mozilla.org/en-US/docs/Glossary/Base64