Binary ArrayBufferView slices send the entire backing buffer

Open Beginner friendly
#202 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
typescript
Domain
api

Research direction

Start in src/core.ts:276 at methodRequest's conversion of non-DataView ArrayBufferView bodies. Reproduce the issue with the sliced Uint8Array example, then add regression coverage for sliced Uint8Array and Buffer values. Done means only the selected bytes are sent and the request body length is 2 bytes.

Written by the indexing model from the issue text.

Description

Description

Binary requests made with a sliced ArrayBufferView send the view's entire backing buffer instead of only the selected byte range.

methodRequest() converts non-DataView views with new DataView(opts.body.buffer) at src/core.ts:276. That drops the original view's byteOffset and byteLength. RequestOptions explicitly accepts ArrayBufferView, so callers can reasonably pass Buffer.subarray(), Uint8Array.subarray(), or another bounded view.

Reproduction
import Browserbase from '@browserbasehq/sdk';

let sentBody: any;
const client = new Browserbase({
  apiKey: 'test',
  maxRetries: 0,
  fetch: async (_url, init) => {
    sentBody = init?.body;
    return new Response('{}', {
      status: 200,
      headers: { 'content-type': 'application/json' },
    });
  },
});

const backing = new Uint8Array([10, 20, 30, 40]);
await client.post('/binary', {
  body: backing.subarray(1, 3),
  __binaryRequest: true,
});

console.log(sentBody.byteLength); // 4, expected 2
console.log([...new Uint8Array(sentBody.buffer)]); // [10, 20, 30, 40]
Expected behavior

Only the selected bytes ([20, 30]) are sent, and the request body/content length is 2 bytes.

Actual behavior

All four bytes in the backing buffer are sent.

Why this matters

This corrupts binary payloads and can disclose adjacent bytes that the caller deliberately excluded with a view. The conversion should preserve byteOffset and byteLength, for example with new DataView(view.buffer, view.byteOffset, view.byteLength), and have regression coverage for sliced Uint8Array/Buffer values.

Tested against @browserbasehq/sdk 2.18.0 / current main (b781bd7).

Dominant language
TypeScript
Stars
64
Forks
17
Avg merge
13m
Merged PRs (30d)
4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from browserbase/sdk-node

All issues in browserbase/sdk-node

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.