Remove ASCII whitespace from atob input, closes #104

Author: mrbbot

packages/core/src/plugins/core.ts

@@ -43,6 +43,8 @@ import {
   ScheduledEvent,
   TextDecoder,
   WorkerGlobalScope,
+  atob,
+  btoa,
   createCompatFetch,
   crypto,
   inputGatedSetInterval,
@@ -67,15 +69,6 @@ function proxyStringFormDataFiles<
   });
 }
 
-// Approximations of atob and btoa for Jest, which doesn't include these in the
-// global scope with jest-environment-node :(
-function atobBuffer(s: string): string {
-  return Buffer.from(s, "base64").toString("binary");
-}
-function btoaBuffer(s: string): string {
-  return Buffer.from(s, "binary").toString("base64");
-}
-
 // Approximation of structuredClone for Node < 17.0.0
 function structuredCloneBuffer<T>(value: T): T {
   return deserialize(serialize(value));
@@ -338,10 +331,8 @@ export class CorePlugin extends Plugin<CoreOptions> implements CoreOptions {
       clearInterval,
       queueMicrotask,
 
-      // Fix for Jest :(, jest-environment-node doesn't include atob/btoa in the
-      // global scope
-      atob: globalThis.atob ?? atobBuffer,
-      btoa: globalThis.btoa ?? btoaBuffer,
+      atob,
+      btoa,
 
       crypto,
       CryptoKey: crypto.CryptoKey,

packages/core/src/standards/encoding.ts

@@ -1,4 +1,5 @@
 import { TextDecoder as BaseTextDecoder } from "util";
+import { DOMException } from "@miniflare/core";
 
 export class TextDecoder extends BaseTextDecoder {
   constructor(
@@ -17,3 +18,39 @@ export class TextDecoder extends BaseTextDecoder {
     super(encoding, options);
   }
 }
+
+// Implementations of base64 functions adapted from Node.js:
+// https://github.com/nodejs/node/blob/1086468aa3d328d2eac00bf66058906553ecd209/lib/buffer.js#L1213-L1239
+//
+// Our `atob` removes all ASCII whitespace (https://infra.spec.whatwg.org/#ascii-whitespace)
+// prior to decoding, as required by the spec (https://infra.spec.whatwg.org/#forgiving-base64-decode),
+// and as implemented by Cloudflare Workers
+//
+// Note, Jest doesn't include btoa or atob in the global scope with
+// jest-environment-node :(, so we'd have to implement it ourselves anyways.
+// Doing this also allows us to use our own DOMException type.
+
+export function btoa(input: string): string {
+  input = `${input}`;
+  for (let n = 0; n < input.length; n++) {
+    if (input[n].charCodeAt(0) > 0xff) {
+      throw new DOMException("Invalid character", "InvalidCharacterError");
+    }
+  }
+  return Buffer.from(input, "latin1").toString("base64");
+}
+
+const BASE_64_DIGITS =
+  "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
+
+export function atob(input: string): string {
+  // Make sure input is a string, removing ASCII whitespace:
+  // https://infra.spec.whatwg.org/#ascii-whitespace
+  input = `${input}`.replace(/[\t\n\f\r ]+/g, "");
+  for (let n = 0; n < input.length; n++) {
+    if (!BASE_64_DIGITS.includes(input[n])) {
+      throw new DOMException("Invalid character", "InvalidCharacterError");
+    }
+  }
+  return Buffer.from(input, "base64").toString("latin1");
+}

packages/core/test/standards/encoding.spec.ts

@@ -1,5 +1,5 @@
 import { TextEncoder } from "util";
-import { TextDecoder } from "@miniflare/core";
+import { DOMException, TextDecoder, atob, btoa } from "@miniflare/core";
 import test, { ThrowsExpectation } from "ava";
 
 const encoder = new TextEncoder();
@@ -23,3 +23,28 @@ test("TextDecoder: only supports utf8 encoding", (t) => {
   // Check non-utf8 encoding not supported by Node nor Workers
   t.throws(() => new TextDecoder("not-an-encoding"), utf8Expectations);
 });
+
+test("btoa: base64 encodes data", (t) => {
+  t.is(btoa("test"), "dGVzdA==");
+});
+test("btoa: throws on invalid character", (t) => {
+  t.throws(() => btoa("✅"), {
+    instanceOf: DOMException,
+    name: "InvalidCharacterError",
+    message: "Invalid character",
+  });
+});
+
+test("atob: base64 encodes data", (t) => {
+  t.is(atob("dGVzdA=="), "test");
+});
+test("atob: removes ASCII whitespace from input", (t) => {
+  t.is(atob(" dG\fV\tz\r\nd  A== "), "test");
+});
+test("atob: throws on invalid character", (t) => {
+  t.throws(() => atob("base64!"), {
+    instanceOf: DOMException,
+    name: "InvalidCharacterError",
+    message: "Invalid character",
+  });
+});