Merge commit from fork

elliott-with-the-longest-name-on-github · web-flow · commit e46afa64dd2b · 2026-01-15T08:48:52.000-07:00
diff --git a/.changeset/swift-planes-fry.md b/.changeset/swift-planes-fry.md
@@ -0,0 +1,5 @@
+---
+"devalue": patch
+---
+
+fix: validate input for typed arrays
diff --git a/src/parse.js b/src/parse.js
@@ -126,7 +126,11 @@ export function unflatten(parsed, revivers) {
 					case 'BigInt64Array':
 					case 'BigUint64Array': {
 						const TypedArrayConstructor = globalThis[type];
-						const typedArray = new TypedArrayConstructor(hydrate(value[1]));
+						const buffer = hydrate(value[1]);
+						if (!(buffer instanceof ArrayBuffer)) {
+							throw new Error(`Invalid input, expected ArrayBuffer but got ${typeof buffer}`);
+						}
+						const typedArray = new TypedArrayConstructor(buffer);
 
 						hydrated[index] =
 							value[2] !== undefined
diff --git a/test/test.js b/test/test.js
@@ -740,6 +740,11 @@ for (const [name, tests] of Object.entries(fixtures)) {
 }
 
 const invalid = [
+	{
+		name: 'typed array with non-ArrayBuffer input',
+		json: '[["Int8Array", 1], { "length": 2 }, 1000000000]',
+		message: 'Invalid input, expected ArrayBuffer but got object'
+	},
 	{
 		name: 'empty string',
 		json: '',

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +---
 +"devalue": patch
 +---
++
 +fix: validate input for typed arrays
Original file line number	Diff line number	Diff line change
`@@ -740,6 +740,11 @@ for (const [name, tests] of Object.entries(fixtures)) {`
`740`	`740`	`}`
`741`	`741`
`742`	`742`	`const invalid = [`
	`743`	`+ {`
	`744`	`+ name: 'typed array with non-ArrayBuffer input',`
	`745`	`+ json: '[["Int8Array", 1], { "length": 2 }, 1000000000]',`
	`746`	`+ message: 'Invalid input, expected ArrayBuffer but got object'`
	`747`	`+ },`
`743`	`748`	`{`
`744`	`749`	`name: 'empty string',`
`745`	`750`	`json: '',`