Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No ES6 Map support? #138

Open
mcclure opened this issue Oct 5, 2020 · 1 comment
Open

No ES6 Map support? #138

mcclure opened this issue Oct 5, 2020 · 1 comment

Comments

@mcclure
Copy link

@mcclure mcclure commented Oct 5, 2020

If I run the following test program with msgpack-javascript 2.1.0:

import { encode, decode } from "@msgpack/msgpack"
const map = new Map()
map.set("a", 1)
map.set("b", 2)
map.set("c", 3)
const encoded = encode(map,{initialBufferSize:128})
const decoded = decode(encoded)
console.log({map, encoded, decoded})

The output is:

Screen Shot 2020-10-04 at 11 40 42 PM

Conclusion: Asking msgpack-javascript to encode a Map causes it to encode it as if it were an empty object.

Supporting Maps in some capacity would be good because if anything it is better to store Maps in msgpack than to store objects. Sometimes deserializing in JavaScript can cause problems or even security flaws if keys overwrite "special" javascript objects like hasOwnProperty or __proto__. Here is an example of such a problem. I suspect msgpack-javascript itself will not have any such security flaws, but it is easy for client code to have such security flaws and the security issues can be sidestepped by using Maps instead of objects.

@gfx
Copy link
Member

@gfx gfx commented Oct 5, 2020

Thank you for your report.

This is the specification and won't be fixed because MessagePack is designed to communicate in multi-languages. I won't add any flavors by default.

However, any JavaScript programs use lots of non-primitive objects, so the MessagePack spec has extensions.
See extension types for details.

Also, I'd like to add extensions to handle non-primitive objects like ES2015's Map, just like as browsers do.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
2 participants
You can’t perform that action at this time.