From: Dmitry Volyntsev <xeioex@nginx.com>
Date: Fri, 30 Oct 2026 01:57:39 +0000 (-0700)
Subject: TextEncoder: fix copy-on-write in encodeInto()
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=45fd801fce15afb43a2ef0c586e39126b997fcd8;p=njs.git

TextEncoder: fix copy-on-write in encodeInto()

Previously, TextEncoder.prototype.encodeInto() wrote directly into the
destination buffer without making a private copy of shared data.  As a
result, encoding into r.requestBuffer in nginx modified the request
body seen by subsequent reads.

Now, the buffer is made writable before the write, as is done for
typed arrays.

The issue was introduced in 409004cb (0.4.4).
---

diff --git a/src/njs_encoding.c b/src/njs_encoding.c
index b1e1d903..6cd298ea 100644
--- a/src/njs_encoding.c
+++ b/src/njs_encoding.c
@@ -199,8 +199,7 @@ njs_text_encoder_encode_into(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs,
     end = start + str.length;
 
     array = njs_typed_array(dest);
-    if (njs_slow_path(njs_is_detached_buffer(array->buffer))) {
-        njs_type_error(vm, "detached buffer");
+    if (njs_slow_path(njs_typed_array_writable(vm, array) == NULL)) {
         return NJS_ERROR;
     }
 
diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c
index d47b2ee5..c4671b6b 100644
--- a/src/test/njs_unit_test.c
+++ b/src/test/njs_unit_test.c
@@ -22044,6 +22044,11 @@ static njs_unit_test_t  njs_externals_test[] =
               "[b[0], new Uint8Array($r.arrayBuffer)[0]]"),
       njs_str("64,208") },
 
+    { njs_str("var b = $r.buffer;"
+              "(new TextEncoder()).encodeInto('@', b);"
+              "[b[0], $r.buffer[0]]"),
+      njs_str("64,208") },
+
     { njs_str("$r.buffer instanceof Buffer"),
       njs_str("true") },