Read the source and its declared rule
This original tiny zlib fixture permits at most 5 decoded bytes per member and 10 overall. Each member claims 1 but actually inflates to 4 bytes. The rule counts actual output byte lengths, not claims or compressed sizes. This post-decode budget demonstration is not protection against hostile decompression allocation.
| Record | Input JSON |
|---|---|
| Base input | {"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1},{"compressed":"eJxzdnZ2BgACogEN","claimedLength":1}]} |
Compare the actual paths
Corrected measured total 4+4+4=12 holds the bundle despite each member fitting 5. The bad metadata sum 1+1+1=3 falsely accepts it.
| Path | Output JSON |
|---|---|
| Misleading path | {"accepted":true,"lengths":[1,1,1],"total":3} |
| Corrected path | {"accepted":false,"lengths":[4,4,4],"total":12} |
import {DatabaseSync} from 'node:sqlite';
import {TextDecoder} from 'node:util';
import {inflateSync} from 'node:zlib';
import {posix} from 'node:path';
import {createHash} from 'node:crypto';
const rows=(db,sql)=>db.prepare(sql).all().map(r=>({...r}));
const failed=(action)=>{try{action();return null;}catch(e){return {code:e.errcode??e.code??e.name};}};
import assert from 'node:assert/strict';
const run=function run(i,corrected=true){
const lengths=i.members.map(m=>corrected?inflateSync(Buffer.from(m.compressed,'base64')).byteLength:m.claimedLength);
const total=lengths.reduce((a,b)=>a+b,0);return {accepted:lengths.every(n=>n<=i.memberLimit)&&total<=i.totalLimit,lengths,total};
};
const cases=[{"label":"misleading base","input":{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1},{"compressed":"eJxzdnZ2BgACogEN","claimedLength":1}]},"expected":{"accepted":true,"lengths":[1,1,1],"total":3},"corrected":false},{"label":"corrected base","input":{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1},{"compressed":"eJxzdnZ2BgACogEN","claimedLength":1}]},"expected":{"accepted":false,"lengths":[4,4,4],"total":12},"corrected":true},{"label":"two actual four-byte members","input":{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1}]},"expected":{"accepted":true,"lengths":[4,4],"total":8},"corrected":true},{"label":"exact actual total limit","input":{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1},{"compressed":"eJxzdgYAAMsAhw==","claimedLength":1}]},"expected":{"accepted":true,"lengths":[4,4,2],"total":10},"corrected":true}];
for(const test of cases){
const actual=run(test.input,test.corrected);
assert.deepEqual(actual,test.expected,test.label);
console.log(test.label,actual);
}
Check boundaries before the next load
Two four-byte members total 8 and pass. Four, four, two total exactly 10 and also pass the inclusive allowance.
| Case | Input JSON | Expected output JSON |
|---|---|---|
| Actual total eight bytes | {"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1}]} | {"accepted":true,"lengths":[4,4],"total":8} |
| Actual total at ten-byte limit | {"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1},{"compressed":"eJxzdgYAAMsAhw==","claimedLength":1}]} | {"accepted":true,"lengths":[4,4,2],"total":10} |
Can three claimed one-byte members be accepted without measurement?
Show the worked answer
No. Actual inflation gives twelve bytes. The supplied ten-byte budget requires holding this bundle.