fix(formData): Stop encoding values to calculate length

Author: FreeMasen

builtins/web/form-data/form-data-encoder.cpp

@@ -9,6 +9,7 @@
 #include "../streams/native-stream-source.h"
 
 #include "encode.h"
+#include "jstypes.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/ResultVariant.h"
 
@@ -42,6 +43,33 @@ size_t compute_normalized_len(std::string_view src) {
   return len;
 }
 
+std::optional<size_t> compute_unencoded_normalized_len(JSContext *cx, JS::HandleString value) {
+  auto linear = JS_EnsureLinearString(cx, value);
+  if (!linear) {
+      return std::nullopt;
+  }
+  auto len = JS::GetDeflatedUTF8StringLength(linear);
+  size_t two_byte_length = JS::GetLinearStringLength(linear);
+  for (size_t i = 0; i < two_byte_length; i++) {
+    char16_t ch = JS::GetLinearStringCharAt(linear, i);
+
+    if (ch == CR) {
+      if (i+1 < two_byte_length) {
+        char16_t next = JS::GetLinearStringCharAt(linear, i+1);
+        if (next == LF) {
+          i += 1;
+          // the character is already accounted for
+          continue;
+        }
+      }
+      len += 1;
+    } else if (ch == LF) {
+      len += 1; // CRLF
+    }
+  }
+  return len;
+}
+
 // Normalizes newlines in a string by replacing:
 // - CR not followed by LF -> CRLF
 // - LF not preceded by CR -> CRLF
@@ -517,12 +545,15 @@ mozilla::Result<size_t, OutOfMemory> MultipartFormDataImpl::query_length(JSConte
       total += 2 * crlf_len;
 
       RootedValue value_str(cx, entry.value);
-      auto value = core::encode(cx, value_str);
+      JS::RootedString value(cx, JS::ToString(cx, value_str));
       if (!value) {
         return mozilla::Result<size_t, OutOfMemory>(OutOfMemory {});
       }
-
-      total += compute_normalized_len(value);
+      auto value_len = compute_unencoded_normalized_len(cx, value);
+      if (!value_len.has_value()) {
+        return mozilla::Result<size_t, OutOfMemory>(OutOfMemory {});
+      }
+      total += value_len.value();
     } else {
       MOZ_ASSERT(File::is_instance(entry.value));
       RootedObject obj(cx, &entry.value.toObject());