Skip to content

Binary ArrayBufferView slices send the entire backing buffer #202

Description

@abhinavkr26104

Description

Binary requests made with a sliced ArrayBufferView send the view's entire backing buffer instead of only the selected byte range.

methodRequest() converts non-DataView views with new DataView(opts.body.buffer) at src/core.ts:276. That drops the original view's byteOffset and byteLength. RequestOptions explicitly accepts ArrayBufferView, so callers can reasonably pass Buffer.subarray(), Uint8Array.subarray(), or another bounded view.

Reproduction

import Browserbase from '@browserbasehq/sdk';

let sentBody: any;
const client = new Browserbase({
  apiKey: 'test',
  maxRetries: 0,
  fetch: async (_url, init) => {
    sentBody = init?.body;
    return new Response('{}', {
      status: 200,
      headers: { 'content-type': 'application/json' },
    });
  },
});

const backing = new Uint8Array([10, 20, 30, 40]);
await client.post('/binary', {
  body: backing.subarray(1, 3),
  __binaryRequest: true,
});

console.log(sentBody.byteLength); // 4, expected 2
console.log([...new Uint8Array(sentBody.buffer)]); // [10, 20, 30, 40]

Expected behavior

Only the selected bytes ([20, 30]) are sent, and the request body/content length is 2 bytes.

Actual behavior

All four bytes in the backing buffer are sent.

Why this matters

This corrupts binary payloads and can disclose adjacent bytes that the caller deliberately excluded with a view. The conversion should preserve byteOffset and byteLength, for example with new DataView(view.buffer, view.byteOffset, view.byteLength), and have regression coverage for sliced Uint8Array/Buffer values.

Tested against @browserbasehq/sdk 2.18.0 / current main (b781bd7).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions