buffer: coerce extrema to int in blob.slice

aduh95 · targos · commit b1ebb0d8ca9e · 2024-10-04T19:20:17.000+02:00
PR-URL: #55141 Fixes: #55139 Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/lib/internal/blob.js b/lib/internal/blob.js
@@ -54,6 +54,7 @@ const {
   lazyDOMException,
 } = require('internal/util');
 const { inspect } = require('internal/util/inspect');
+const { convertToInt } = require('internal/webidl');
 
 const {
   codes: {
@@ -239,6 +240,12 @@ class Blob {
   slice(start = 0, end = this[kLength], contentType = '') {
     if (!isBlob(this))
       throw new ERR_INVALID_THIS('Blob');
+
+    // Coerce values to int
+    const opts = { __proto__: null, signed: true };
+    start = convertToInt('start', start, 64, opts);
+    end = convertToInt('end', end, 64, opts);
+
     if (start < 0) {
       start = MathMax(this[kLength] + start, 0);
     } else {
diff --git a/test/parallel/test-blob.js b/test/parallel/test-blob.js
@@ -483,6 +483,7 @@ assert.throws(() => new Blob({}), {
 
   assert.ok(blob.slice(0, 1).constructor === Blob);
   assert.ok(blob.slice(0, 1) instanceof Blob);
+  assert.ok(blob.slice(0, 1.5) instanceof Blob);
 }
 
 (async () => {

Original file line number	Diff line number	Diff line change
`@@ -483,6 +483,7 @@ assert.throws(() => new Blob({}), {`
`483`	`483`
`484`	`484`	`assert.ok(blob.slice(0, 1).constructor === Blob);`
`485`	`485`	`assert.ok(blob.slice(0, 1) instanceof Blob);`
	`486`	`+ assert.ok(blob.slice(0, 1.5) instanceof Blob);`
`486`	`487`	`}`
`487`	`488`
`488`	`489`	`(async () => {`