跳至內容
Astera Technology

各檔看似細,整包為何仍超過配額?

量真正解碼後字節長度,同時核各項與整包配額。

下載完整個案資料及參考答案 ↓

先核來源與已訂規則

本例小型 zlib 資料,每項解後最多 5 字節、整包 10。各項聲稱 1,真正解開卻各 4。規則計實際輸出字節,不計聲明或壓縮大小;這是解後配額示範,不是防惡意解壓分配機制。

已填假設輸入
紀錄輸入 JSON
原例輸入{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1},{"compressed":"eJxzdnZ2BgACogEN","claimedLength":1}]}
下載可編輯 CSV ↓

比較兩條實際路徑

更正實量 4+4+4=12,雖每項未超 5,整包仍須停;錯聲明合計 1+1+1=3 卻收了。

錯誤與更正路徑的輸出
路徑輸出 JSON
錯誤路徑{"accepted":true,"lengths":[1,1,1],"total":3}
更正路徑{"accepted":false,"lengths":[4,4,4],"total":12}
下載可編輯 CSV ↓
本地 Node.js 程序:22.23.3 或 24.14.1
import {DatabaseSync} from 'node:sqlite';
import {TextDecoder} from 'node:util';
import {inflateSync} from 'node:zlib';
import {posix} from 'node:path';
import {createHash} from 'node:crypto';
const rows=(db,sql)=>db.prepare(sql).all().map(r=>({...r}));
const failed=(action)=>{try{action();return null;}catch(e){return {code:e.errcode??e.code??e.name};}};

import assert from 'node:assert/strict';
const run=function run(i,corrected=true){
    const lengths=i.members.map(m=>corrected?inflateSync(Buffer.from(m.compressed,'base64')).byteLength:m.claimedLength);
    const total=lengths.reduce((a,b)=>a+b,0);return {accepted:lengths.every(n=>n<=i.memberLimit)&&total<=i.totalLimit,lengths,total};
  };
const cases=[{"label":"misleading base","input":{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1},{"compressed":"eJxzdnZ2BgACogEN","claimedLength":1}]},"expected":{"accepted":true,"lengths":[1,1,1],"total":3},"corrected":false},{"label":"corrected base","input":{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1},{"compressed":"eJxzdnZ2BgACogEN","claimedLength":1}]},"expected":{"accepted":false,"lengths":[4,4,4],"total":12},"corrected":true},{"label":"two actual four-byte members","input":{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1}]},"expected":{"accepted":true,"lengths":[4,4],"total":8},"corrected":true},{"label":"exact actual total limit","input":{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1},{"compressed":"eJxzdgYAAMsAhw==","claimedLength":1}]},"expected":{"accepted":true,"lengths":[4,4,2],"total":10},"corrected":true}];
for(const test of cases){
  const actual=run(test.input,test.corrected);
  assert.deepEqual(actual,test.expected,test.label);
  console.log(test.label,actual);
}
下載可執行例子 ↓

下次載入前核邊界

兩個四字節項總 8 可過;四、四、二剛好 10,也符包含上限的配額。

可編輯邊界紀錄及預期輸出
情況輸入 JSON預期輸出 JSON
實際合計八字節{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1}]}{"accepted":true,"lengths":[4,4],"total":8}
實際剛好十字節上限{"memberLimit":5,"totalLimit":10,"members":[{"compressed":"eJxzdHR0BAACjgEF","claimedLength":1},{"compressed":"eJxzcnJyAgACmAEJ","claimedLength":1},{"compressed":"eJxzdgYAAMsAhw==","claimedLength":1}]}{"accepted":true,"lengths":[4,4,2],"total":10}
下載可編輯 CSV ↓

三項都聲稱一字節,未量可否直接收?

查看參考答案

不可,真正解開十二字節,本例十字節配額須暫停整包。

相關資源