Skip to content
This repository was archived by the owner on May 28, 2026. It is now read-only.

Commit 2c9a84c

Browse files
committed
[Fix] Buffer.concat looses taint nodejs#20
1 parent ab7f1e3 commit 2c9a84c

2 files changed

Lines changed: 15 additions & 1 deletion

File tree

‎lib/_taint_buffer_util.js‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -284,6 +284,20 @@ exports.applyTaintToBuffer = (buffer, string, encoding,
284284
return buffer;
285285
};
286286

287+
exports.concatBufferArrayTaint = (list) => {
288+
return list.reduce((acc, val) => {
289+
if (typeof val === 'object' && val.taint) {
290+
val.taint.forEach((range) => {
291+
acc.taint.push({'begin': range.begin + acc.len,
292+
'end': range.end + acc.len,
293+
'flow': range.flow
294+
});
295+
});
296+
}
297+
acc.len += val.len;
298+
return acc;
299+
}, {'len': 0, 'taint': []}).taint;
300+
};
287301

288302
exports.applyArrayTaintToBuffer = (array) => {
289303
const newTaint = [];

‎lib/buffer.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -510,7 +510,7 @@ Buffer.concat = function concat(list, length) {
510510
}
511511

512512
// TaintV8
513-
buffer.taint = TaintBuffer.subtaint(buffer, 0, length);
513+
buffer.taint = TaintBuffer.concatBufferArrayTaint(list);
514514

515515
// Note: `length` is always equal to `buffer.length` at this point
516516
if (pos < length) {

0 commit comments

Comments
 (0)