search

ipld / js-dag-cbor

dag-cbor codec for IPLD
Other
27 stars 17 forks source link

fix: reject CBOR data with extraneous back-to-back encoded data #5

Closed rvagg closed 4 years ago

rvagg commented 4 years ago

Same as https://github.com/ipld/js-ipld-dag-cbor/pull/130

The streaming form of CBOR (3.1) may use back-to-back top-level objects without an explicit container and borc will decode this without failure. decodeFirst() will only return the first of these but additional data may exist but be hidden.

Ref: https://github.com/ipld/js-ipld-dag-cbor/pull/130 Ref: https://github.com/dignifiedquire/borc/issues/47#issuecomment-642432759 Ref: https://github.com/ipld/specs/pull/268

rvagg commented 4 years ago

cherry-picked to master as 27a3617