From 45fd801fce15afb43a2ef0c586e39126b997fcd8 Mon Sep 17 00:00:00 2001 From: Dmitry Volyntsev Date: Thu, 29 Oct 2026 18:57:39 -0700 Subject: [PATCH] TextEncoder: fix copy-on-write in encodeInto() Previously, TextEncoder.prototype.encodeInto() wrote directly into the destination buffer without making a private copy of shared data. As a result, encoding into r.requestBuffer in nginx modified the request body seen by subsequent reads. Now, the buffer is made writable before the write, as is done for typed arrays. The issue was introduced in 409004cb (0.4.4). --- src/njs_encoding.c | 3 +-- src/test/njs_unit_test.c | 5 +++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/njs_encoding.c b/src/njs_encoding.c index b1e1d903..6cd298ea 100644 --- a/src/njs_encoding.c +++ b/src/njs_encoding.c @@ -199,8 +199,7 @@ njs_text_encoder_encode_into(njs_vm_t *vm, njs_value_t *args, njs_uint_t nargs, end = start + str.length; array = njs_typed_array(dest); - if (njs_slow_path(njs_is_detached_buffer(array->buffer))) { - njs_type_error(vm, "detached buffer"); + if (njs_slow_path(njs_typed_array_writable(vm, array) == NULL)) { return NJS_ERROR; } diff --git a/src/test/njs_unit_test.c b/src/test/njs_unit_test.c index d47b2ee5..c4671b6b 100644 --- a/src/test/njs_unit_test.c +++ b/src/test/njs_unit_test.c @@ -22044,6 +22044,11 @@ static njs_unit_test_t njs_externals_test[] = "[b[0], new Uint8Array($r.arrayBuffer)[0]]"), njs_str("64,208") }, + { njs_str("var b = $r.buffer;" + "(new TextEncoder()).encodeInto('@', b);" + "[b[0], $r.buffer[0]]"), + njs_str("64,208") }, + { njs_str("$r.buffer instanceof Buffer"), njs_str("true") }, -- 2.47.3