feat(javascript): add configurable size guardrails

javascript/packages/core/lib/fory.ts

@@ -32,6 +32,8 @@ import { MetaStringResolver } from "./metaStringResolver";
 
 const DEFAULT_DEPTH_LIMIT = 50 as const;
 const MIN_DEPTH_LIMIT = 2 as const;
+const DEFAULT_MAX_COLLECTION_SIZE = 1_000_000 as const;
+const DEFAULT_MAX_BINARY_SIZE = 64 * 1024 * 1024; // 64 MiB
 
 export default class {
   binaryReader: BinaryReader;
@@ -45,6 +47,8 @@ export default class {
   config: Config;
   depth = 0;
   maxDepth: number;
+  maxBinarySize: number;
+  maxCollectionSize: number;
 
   constructor(config?: Partial<Config>) {
     this.config = this.initConfig(config);
@@ -53,6 +57,16 @@ export default class {
       throw new Error(`maxDepth must be an integer >= ${MIN_DEPTH_LIMIT} but got ${maxDepth}`);
     }
     this.maxDepth = maxDepth;
+    const maxBinarySize = config?.maxBinarySize ?? DEFAULT_MAX_BINARY_SIZE;
+    if (!Number.isInteger(maxBinarySize) || maxBinarySize < 0) {
+      throw new Error(`maxBinarySize must be a non-negative integer but got ${maxBinarySize}`);
+    }
+    this.maxBinarySize = maxBinarySize;
+    const maxCollectionSize = config?.maxCollectionSize ?? DEFAULT_MAX_COLLECTION_SIZE;
+    if (!Number.isInteger(maxCollectionSize) || maxCollectionSize < 0) {
+      throw new Error(`maxCollectionSize must be a non-negative integer but got ${maxCollectionSize}`);
+    }
+    this.maxCollectionSize = maxCollectionSize;
     this.binaryReader = new BinaryReader(this.config);
     this.binaryWriter = new BinaryWriter(this.config);
     this.referenceResolver = new ReferenceResolver(this.binaryReader);
@@ -68,6 +82,8 @@ export default class {
       refTracking: config?.refTracking !== null ? Boolean(config?.refTracking) : null,
       useSliceString: Boolean(config?.useSliceString),
       maxDepth: config?.maxDepth,
+      maxBinarySize: config?.maxBinarySize,
+      maxCollectionSize: config?.maxCollectionSize,
       hooks: config?.hooks || {},
       compatible: Boolean(config?.compatible),
     };
@@ -91,6 +107,24 @@ export default class {
     this.depth--;
   }
 
+  checkCollectionSize(size: number): void {
+    if (size > this.maxCollectionSize) {
+      throw new Error(
+        `Collection size ${size} exceeds maxCollectionSize ${this.maxCollectionSize}. `
+        + "The data may be malicious, or increase maxCollectionSize if needed."
+      );
+    }
+  }
+
+  checkBinarySize(size: number): void {
+    if (size > this.maxBinarySize) {
+      throw new Error(
+        `Binary size ${size} exceeds maxBinarySize ${this.maxBinarySize}. `
+        + "The data may be malicious, or increase maxBinarySize if needed."
+      );
+    }
+  }
+
   private resetRead(): void {
     this.referenceResolver.resetRead();
     this.typeMetaResolver.resetRead();

javascript/packages/core/lib/gen/collection.ts

@@ -152,6 +152,7 @@ class CollectionAnySerializer {
   read(accessor: (result: any, index: number, v: any) => void, createCollection: (len: number) => any, fromRef: boolean): any {
     void fromRef;
     const len = this.fory.binaryReader.readVarUint32Small7();
+    this.fory.checkCollectionSize(len);
     const flags = this.fory.binaryReader.readUint8();
     const isSame = flags & CollectionFlags.SAME_TYPE;
     const includeNone = flags & CollectionFlags.HAS_NULL;
@@ -304,6 +305,7 @@ export abstract class CollectionSerializerGenerator extends BaseSerializerGenera
     const refFlag = this.scope.uniqueName("refFlag");
     return `
             const ${len} = ${this.builder.reader.readVarUint32Small7()};
+            fory.checkCollectionSize(${len});
             const ${flags} = ${this.builder.reader.readUint8()};
             const ${result} = ${this.newCollection(len)};
             ${this.maybeReference(result, refState)}

javascript/packages/core/lib/gen/map.ts

@@ -242,6 +242,7 @@ class MapAnySerializer {
 
   read(fromRef: boolean): any {
     let count = this.fory.binaryReader.readVarUint32Small7();
+    this.fory.checkCollectionSize(count);
     const result = new Map();
     if (fromRef) {
       this.fory.referenceResolver.reference(result);
@@ -409,6 +410,7 @@ export class MapSerializerGenerator extends BaseSerializerGenerator {
 
     return `
       let ${count} = ${this.builder.reader.readVarUint32Small7()};
+      fory.checkCollectionSize(${count});
       const ${result} = new Map();
       if (${refState}) {
         ${this.builder.referenceResolver.reference(result)}

javascript/packages/core/lib/gen/typedArray.ts

@@ -47,6 +47,7 @@ function build(inner: TypeInfo, creator: string, size: number) {
 
       return `
                 const ${len} = ${this.builder.reader.readVarUInt32()};
+                fory.checkBinarySize(${len});
                 const ${copied} = ${this.builder.reader.buffer(len)}
                 const ${result} = new ${creator}(${copied}.buffer, ${copied}.byteOffset, ${copied}.byteLength / ${size});
                 ${this.maybeReference(result, refState)}
@@ -85,6 +86,7 @@ class BoolArraySerializerGenerator extends BaseSerializerGenerator {
     const idx = this.scope.uniqueName("idx");
     return `
                 const ${len} = ${this.builder.reader.readVarUInt32()};
+                fory.checkCollectionSize(${len});
                 const ${result} = new Array(${len});
                 ${this.maybeReference(result, refState)}
                 for (let ${idx} = 0; ${idx} < ${len}; ${idx}++) {
@@ -120,10 +122,13 @@ class Float16ArraySerializerGenerator extends BaseSerializerGenerator {
 
   read(accessor: (expr: string) => string, refState: string): string {
     const result = this.scope.uniqueName("result");
+    const rawLen = this.scope.uniqueName("rawLen");
     const len = this.scope.uniqueName("len");
     const idx = this.scope.uniqueName("idx");
     return `
-        const ${len} = ${this.builder.reader.readVarUInt32()} / 2;
+        const ${rawLen} = ${this.builder.reader.readVarUInt32()};
+        fory.checkBinarySize(${rawLen});
+        const ${len} = ${rawLen} / 2;
         const ${result} = new Array(${len});
         ${this.maybeReference(result, refState)}
         for (let ${idx} = 0; ${idx} < ${len}; ${idx}++) {
@@ -159,10 +164,13 @@ class BFloat16ArraySerializerGenerator extends BaseSerializerGenerator {
 
   read(accessor: (expr: string) => string, refState: string): string {
     const result = this.scope.uniqueName("result");
+    const rawLen = this.scope.uniqueName("rawLen");
     const len = this.scope.uniqueName("len");
     const idx = this.scope.uniqueName("idx");
     return `
-        const ${len} = ${this.builder.reader.readVarUInt32()} / 2;
+        const ${rawLen} = ${this.builder.reader.readVarUInt32()};
+        fory.checkBinarySize(${rawLen});
+        const ${len} = ${rawLen} / 2;
         const ${result} = new Array(${len});
         ${this.maybeReference(result, refState)}
         for (let ${idx} = 0; ${idx} < ${len}; ${idx}++) {

javascript/packages/core/lib/type.ts

@@ -265,6 +265,8 @@ export interface Config {
   refTracking: boolean | null;
   useSliceString: boolean;
   maxDepth?: number;
+  maxBinarySize?: number;
+  maxCollectionSize?: number;
   hooks: {
     afterCodeGenerated?: (code: string) => string;
   };