Reject symbol-keyed map objects in wasm conversion

.changeset/thirty-peas-love.md

@@ -0,0 +1,6 @@
+---
+"loro-crdt": patch
+"loro-crdt-map": patch
+---
+
+fix: Reject symbol-keyed map objects in wasm conversion #855

crates/loro-wasm/src/convert.rs

@@ -516,8 +516,13 @@ pub(crate) fn js_to_map_delta(js: &JsValue) -> Result<ResolvedMapDelta, JsValue>
     let entries = Object::entries(obj);
     for i in 0..entries.length() {
         let entry = entries.get(i);
-        let entry_arr = entry.dyn_ref::<Array>().unwrap();
-        let key = entry_arr.get(0).as_string().unwrap();
+        let entry_arr = entry
+            .dyn_into::<Array>()
+            .map_err(|_| JsValue::from_str("Invalid map delta entry"))?;
+        let key = entry_arr
+            .get(0)
+            .as_string()
+            .ok_or_else(|| JsValue::from_str("Map delta keys must be strings"))?;
         let value = entry_arr.get(1);
 
         if value.is_undefined() {
@@ -541,11 +546,12 @@ pub(crate) fn js_to_map_delta(js: &JsValue) -> Result<ResolvedMapDelta, JsValue>
                 }
             }
         }
+        let loro_value = js_value_to_loro_value(&value)?;
         delta = delta.with_entry(
             key.into(),
             ResolvedMapValue {
                 idlp: IdLp::new(0, 0),
-                value: Some(ValueOrHandler::Value(js_value_to_loro_value(&value))),
+                value: Some(ValueOrHandler::Value(loro_value)),
             },
         );
     }
@@ -592,8 +598,8 @@ pub(crate) fn js_value_to_list_diff(js: &JsValue) -> Result<ListDiff, JsValue> {
                     }
                 }
                 values
-                    .push(ValueOrHandler::Value(js_value_to_loro_value(&value)))
-                    .unwrap()
+                    .push(ValueOrHandler::Value(js_value_to_loro_value(&value)?))
+                    .map_err(|_| JsValue::from_str("Insert array exceeds maximum supported length"))?
             }
 
             builder = builder.insert(values, ListDeltaMeta::default());
@@ -605,49 +611,82 @@ pub(crate) fn js_value_to_list_diff(js: &JsValue) -> Result<ListDiff, JsValue> {
     Ok(builder.build())
 }
 
-pub(crate) fn js_value_to_loro_value(js: &JsValue) -> LoroValue {
-    if js.is_null() {
-        LoroValue::Null
+pub(crate) fn js_value_to_loro_value(js: &JsValue) -> JsResult<LoroValue> {
+    if js.is_null() || js.is_undefined() {
+        return Ok(LoroValue::Null);
     } else if let Some(b) = js.as_bool() {
-        LoroValue::Bool(b)
+        return Ok(LoroValue::Bool(b));
     } else if let Some(n) = js.as_f64() {
         if n.fract() == 0.0 && n >= -(2i64.pow(53) as f64) && n <= 2i64.pow(53) as f64 {
-            LoroValue::I64(n as i64)
+            return Ok(LoroValue::I64(n as i64));
         } else {
-            LoroValue::Double(n)
+            return Ok(LoroValue::Double(n));
         }
     } else if let Some(s) = js.as_string() {
         if let Some(cid) = ContainerID::try_from_loro_value_string(&s) {
-            LoroValue::Container(cid)
+            return Ok(LoroValue::Container(cid));
         } else {
-            LoroValue::String(s.into())
+            return Ok(LoroValue::String(s.into()));
         }
     } else if js.is_array() {
         let arr = Array::from(js);
         let mut vec = Vec::with_capacity(arr.length() as usize);
         for i in 0..arr.length() {
-            vec.push(js_value_to_loro_value(&arr.get(i)));
+            vec.push(js_value_to_loro_value(&arr.get(i))?);
         }
-        LoroValue::List(LoroListValue::from(vec))
+        return Ok(LoroValue::List(LoroListValue::from(vec)));
     } else if js.is_object() {
+        if js.is_instance_of::<Uint8Array>() {
+            let typed_array = Uint8Array::new(js);
+            let mut buf = vec![0; typed_array.length() as usize];
+            typed_array.copy_to(&mut buf[..]);
+            return Ok(LoroValue::Binary(buf.into()));
+        }
+
+        if let Some(map) = js.dyn_ref::<Map>() {
+            let entries = Array::from(&map.entries().into());
+            let mut loro_map = FxHashMap::default();
+            for i in 0..entries.length() {
+                let entry = entries
+                    .get(i)
+                    .dyn_into::<Array>()
+                    .map_err(|_| JsValue::from_str("Invalid map entry"))?;
+                let key = entry
+                    .get(0)
+                    .as_string()
+                    .ok_or_else(|| JsValue::from_str("Map keys must be strings"))?;
+                let value = entry.get(1);
+                loro_map.insert(key, js_value_to_loro_value(&value)?);
+            }
+            return Ok(LoroValue::Map(LoroMapValue::from(loro_map)));
+        }
+
         let obj = Object::from(JsValue::from(js));
+
+        if Object::get_own_property_symbols(&obj).length() > 0 {
+            return Err(JsValue::from_str(
+                "Object keys must be strings; symbol properties are not supported",
+            )
+            .into());
+        }
         let mut map = FxHashMap::default();
         let entries = Object::entries(&obj);
         for i in 0..entries.length() {
-            let entry = entries.get(i);
+            let entry = entries
+                .get(i)
+                .dyn_into::<Array>()
+                .map_err(|_| JsValue::from_str("Invalid object entry"))?;
             let key = entry
-                .dyn_ref::<Array>()
-                .unwrap()
                 .get(0)
                 .as_string()
-                .unwrap();
-            let value = entry.dyn_ref::<Array>().unwrap().get(1);
-            map.insert(key, js_value_to_loro_value(&value));
+                .ok_or_else(|| JsValue::from_str("Object keys must be strings"))?;
+            let value = entry.get(1);
+            map.insert(key, js_value_to_loro_value(&value)?);
         }
-        LoroValue::Map(LoroMapValue::from(map))
-    } else {
-        LoroValue::Null
+        return Ok(LoroValue::Map(LoroMapValue::from(map)));
     }
+
+    Err(JsValue::from_str("Unsupported value type"))
 }
 
 /// Convert a JavaScript JsonSchema (or string) to Loro's internal JsonSchema

crates/loro-wasm/src/lib.rs

@@ -7,7 +7,8 @@
 
 use convert::{
     import_status_to_js_value, js_diff_to_inner_diff, js_json_schema_to_loro_json_schema,
-    js_to_id_span, js_to_version_vector, loro_json_schema_to_js_json_schema, resolved_diff_to_js,
+    js_to_id_span, js_to_version_vector, js_value_to_loro_value,
+    loro_json_schema_to_js_json_schema, resolved_diff_to_js,
 };
 use js_sys::{Array, Object, Promise, Reflect, Uint8Array};
 use loro_internal::{
@@ -2745,10 +2746,13 @@ impl LoroText {
     /// text.insert(0, "Hello World!");
     /// text.mark({ start: 0, end: 5 }, "bold", true);
     /// ```
-    pub fn mark(&self, range: JsRange, key: &str, value: JsValue) -> Result<(), JsError> {
-        let range: MarkRange = serde_wasm_bindgen::from_value(range.into())?;
-        let value: LoroValue = LoroValue::from(value);
-        self.handler.mark(range.start, range.end, key, value)?;
+    pub fn mark(&self, range: JsRange, key: &str, value: JsValue) -> JsResult<()> {
+        let range: MarkRange = serde_wasm_bindgen::from_value(range.into())
+            .map_err(|err| JsValue::from_str(&err.to_string()))?;
+        let loro_value = js_value_to_loro_value(&value)?;
+        self.handler
+            .mark(range.start, range.end, key, loro_value)
+            .map_err(JsValue::from)?;
         Ok(())
     }
 
@@ -3022,8 +3026,9 @@ impl LoroMap {
     /// ```
     #[wasm_bindgen(js_name = "set", skip_typescript)]
     pub fn insert(&mut self, key: &str, value: JsLoroValue) -> JsResult<()> {
-        let v: JsValue = value.into();
-        self.handler.insert(key, v)?;
+        let js_value: JsValue = value.into();
+        let loro_value = js_value_to_loro_value(&js_value)?;
+        self.handler.insert(key, loro_value)?;
         Ok(())
     }
 
@@ -3396,8 +3401,9 @@ impl LoroList {
     /// ```
     #[wasm_bindgen(skip_typescript)]
     pub fn insert(&mut self, index: usize, value: JsLoroValue) -> JsResult<()> {
-        let v: JsValue = value.into();
-        self.handler.insert(index, v)?;
+        let js_value: JsValue = value.into();
+        let loro_value = js_value_to_loro_value(&js_value)?;
+        self.handler.insert(index, loro_value)?;
         Ok(())
     }
 
@@ -3642,8 +3648,9 @@ impl LoroList {
     /// Push a value to the end of the list.
     #[wasm_bindgen(skip_typescript)]
     pub fn push(&self, value: JsLoroValue) -> JsResult<()> {
-        let v: JsValue = value.into();
-        self.handler.push(v)?;
+        let js_value: JsValue = value.into();
+        let loro_value = js_value_to_loro_value(&js_value)?;
+        self.handler.push(loro_value)?;
         Ok(())
     }
 
@@ -3751,8 +3758,9 @@ impl LoroMovableList {
     /// ```
     #[wasm_bindgen(skip_typescript)]
     pub fn insert(&mut self, index: usize, value: JsLoroValue) -> JsResult<()> {
-        let v: JsValue = value.into();
-        self.handler.insert(index, v)?;
+        let js_value: JsValue = value.into();
+        let loro_value = js_value_to_loro_value(&js_value)?;
+        self.handler.insert(index, loro_value)?;
         Ok(())
     }
 
@@ -4019,8 +4027,9 @@ impl LoroMovableList {
     /// and the final result will be `[1, 100, 200, 3]` or `[1, 200, 100, 3]`.
     #[wasm_bindgen(skip_typescript)]
     pub fn set(&self, pos: usize, value: JsLoroValue) -> JsResult<()> {
-        let v: JsValue = value.into();
-        self.handler.set(pos, v)?;
+        let js_value: JsValue = value.into();
+        let loro_value = js_value_to_loro_value(&js_value)?;
+        self.handler.set(pos, loro_value)?;
         Ok(())
     }
 
@@ -4035,8 +4044,9 @@ impl LoroMovableList {
     /// Push a value to the end of the list.
     #[wasm_bindgen(skip_typescript)]
     pub fn push(&self, value: JsLoroValue) -> JsResult<()> {
-        let v: JsValue = value.into();
-        self.handler.push(v.into())?;
+        let js_value: JsValue = value.into();
+        let loro_value = js_value_to_loro_value(&js_value)?;
+        self.handler.push(loro_value)?;
         Ok(())
     }
 

crates/loro-wasm/tests/misc.test.ts

@@ -9,6 +9,19 @@ import {
 import { expectTypeOf } from "vitest";
 import { expectDefined } from "./helpers";
 
+function expectErrorWithCasting(action: () => unknown, matcher: RegExp) {
+  expect(() => {
+    try {
+      action();
+    } catch (err) {
+      if (err instanceof Error) {
+        throw err;
+      }
+      throw new Error(String(err));
+    }
+  }).toThrowError(matcher);
+}
+
 function assertEquals(a: any, b: any) {
   expect(a).toStrictEqual(b);
 }
@@ -178,6 +191,67 @@ describe("sync", () => {
   });
 });
 
+describe("LoroMap value conversion", () => {
+  it("should throw when setting objects with symbol keys", () => {
+    const loro = new LoroDoc<{ map: LoroMap }>();
+    const map = loro.getMap("map");
+
+    const symbolKey = Symbol("test");
+    const valueWithSymbolKey = { [symbolKey]: "value" };
+
+    expectErrorWithCasting(
+      () => map.set("key", valueWithSymbolKey as any),
+      /Object keys must be strings/,
+    );
+  });
+
+  it("should throw when nested objects contain symbol keys", () => {
+    const loro = new LoroDoc<{ map: LoroMap }>();
+    const map = loro.getMap("map");
+
+    const symbolKey = Symbol("nested");
+    const nestedValue = { outer: { [symbolKey]: 42 } };
+
+    expectErrorWithCasting(
+      () => map.set("key", nestedValue as any),
+      /Object keys must be strings/,
+    );
+  });
+
+  it("coerces undefined map values to null via conversion", () => {
+    const loro = new LoroDoc<{ map: LoroMap }>();
+    const map = loro.getMap("map");
+
+    map.set("key", undefined as any);
+
+    expect(map.toJSON()).toStrictEqual({ key: null });
+  });
+});
+
+describe("LoroList value conversion", () => {
+  it("coerces undefined list entries to null", () => {
+    const loro = new LoroDoc<{ list: LoroList }>();
+    const list = loro.getList("list");
+
+    list.insert(0, undefined as any);
+
+    expect(list.toJSON()).toStrictEqual([null]);
+  });
+
+  it("should throw when inserting objects with symbol keys", () => {
+    const loro = new LoroDoc<{ list: LoroList }>();
+    const list = loro.getList("list");
+
+    const symbolKey = Symbol("invalid");
+    const valueWithSymbolKey = { [symbolKey]: "value" };
+
+    expectErrorWithCasting(
+      () => list.insert(0, valueWithSymbolKey as any),
+      /Object keys must be strings/,
+    );
+  });
+});
+
 describe("wasm", () => {
   const loro = new LoroDoc();
   const a = loro.getText("ha");