Description
Binary requests made with a sliced ArrayBufferView send the view's entire backing buffer instead of only the selected byte range.
methodRequest() converts non-DataView views with new DataView(opts.body.buffer) at src/core.ts:276. That drops the original view's byteOffset and byteLength. RequestOptions explicitly accepts ArrayBufferView, so callers can reasonably pass Buffer.subarray(), Uint8Array.subarray(), or another bounded view.
Reproduction
import Browserbase from '@browserbasehq/sdk';
let sentBody: any;
const client = new Browserbase({
apiKey: 'test',
maxRetries: 0,
fetch: async (_url, init) => {
sentBody = init?.body;
return new Response('{}', {
status: 200,
headers: { 'content-type': 'application/json' },
});
},
});
const backing = new Uint8Array([10, 20, 30, 40]);
await client.post('/binary', {
body: backing.subarray(1, 3),
__binaryRequest: true,
});
console.log(sentBody.byteLength); // 4, expected 2
console.log([...new Uint8Array(sentBody.buffer)]); // [10, 20, 30, 40]
Expected behavior
Only the selected bytes ([20, 30]) are sent, and the request body/content length is 2 bytes.
Actual behavior
All four bytes in the backing buffer are sent.
Why this matters
This corrupts binary payloads and can disclose adjacent bytes that the caller deliberately excluded with a view. The conversion should preserve byteOffset and byteLength, for example with new DataView(view.buffer, view.byteOffset, view.byteLength), and have regression coverage for sliced Uint8Array/Buffer values.
Tested against @browserbasehq/sdk 2.18.0 / current main (b781bd7).
Description
Binary requests made with a sliced
ArrayBufferViewsend the view's entire backing buffer instead of only the selected byte range.methodRequest()converts non-DataViewviews withnew DataView(opts.body.buffer)atsrc/core.ts:276. That drops the original view'sbyteOffsetandbyteLength.RequestOptionsexplicitly acceptsArrayBufferView, so callers can reasonably passBuffer.subarray(),Uint8Array.subarray(), or another bounded view.Reproduction
Expected behavior
Only the selected bytes (
[20, 30]) are sent, and the request body/content length is 2 bytes.Actual behavior
All four bytes in the backing buffer are sent.
Why this matters
This corrupts binary payloads and can disclose adjacent bytes that the caller deliberately excluded with a view. The conversion should preserve
byteOffsetandbyteLength, for example withnew DataView(view.buffer, view.byteOffset, view.byteLength), and have regression coverage for slicedUint8Array/Buffervalues.Tested against
@browserbasehq/sdk2.18.0 / currentmain(b781bd7).