Bounds checking when creating cursor

Author: ept

frontend/cursor.js

@@ -9,6 +9,7 @@ const { isObject } = require('../src/common')
 class Cursor {
   constructor(object, index, elemId = undefined) {
     if (Array.isArray(object) && object[ELEM_IDS] && typeof index === 'number') {
+      if (index < 0 || index >= object[ELEM_IDS].length) throw new RangeError('list index out of bounds')
       this.objectId = object[OBJECT_ID]
       this.elemId = object[ELEM_IDS][index]
       this.index = index

frontend/text.js

@@ -33,6 +33,7 @@ class Text {
   }
 
   getElemId (index) {
+    if (index < 0 || index >= this.elems.length) throw new RangeError('text index out of bounds')
     return this.elems[index].elemId
   }
 

test/cursor_test.js

@@ -39,4 +39,19 @@ describe('Automerge.Cursor', () => {
     assert.ok(s3.cursor instanceof Automerge.Cursor)
     assert.strictEqual(s3.cursor.elemId, `4@${Automerge.getActorId(s1)}`)
   })
+
+  it('should not allow an index beyond the length of the list', () => {
+    assert.throws(() => {
+      Automerge.change(Automerge.init(), doc => {
+        doc.list = [1]
+        doc.cursor = new Automerge.Cursor(doc.list, 1)
+      })
+    }, /index out of bounds/)
+    assert.throws(() => {
+      Automerge.change(Automerge.init(), doc => {
+        doc.text = new Automerge.Text('a')
+        doc.cursor = doc.text.getCursorAt(1)
+      })
+    }, /index out of bounds/)
+  })
 })