buffer: coerce extrema to int in blob.slice

PR-URL: #55141 Fixes: #55139 Reviewed-By: Benjamin Gruenbaum <[email protected]> Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: James M Snell <[email protected]>
nodejs · Oct 4, 2024 · b1ebb0d · b1ebb0d
1 parent 1240197
commit b1ebb0d
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/lib/internal/blob.js b/lib/internal/blob.js
@@ -54,6 +54,7 @@ const {
   lazyDOMException,
 } = require('internal/util');
 const { inspect } = require('internal/util/inspect');
+const { convertToInt } = require('internal/webidl');
 
 const {
   codes: {
@@ -239,6 +240,12 @@ class Blob {
   slice(start = 0, end = this[kLength], contentType = '') {
     if (!isBlob(this))
       throw new ERR_INVALID_THIS('Blob');
+
+    // Coerce values to int
+    const opts = { __proto__: null, signed: true };
+    start = convertToInt('start', start, 64, opts);
+    end = convertToInt('end', end, 64, opts);
+
     if (start < 0) {
       start = MathMax(this[kLength] + start, 0);
     } else {

diff --git a/test/parallel/test-blob.js b/test/parallel/test-blob.js
@@ -483,6 +483,7 @@ assert.throws(() => new Blob({}), {
 
   assert.ok(blob.slice(0, 1).constructor === Blob);
   assert.ok(blob.slice(0, 1) instanceof Blob);
+  assert.ok(blob.slice(0, 1.5) instanceof Blob);
 }
 
 (async () => {