-
Type: Improvement
-
Resolution: Unresolved
-
Priority: Major - P3
-
None
-
Affects Version/s: bson-4.0.2
-
Component/s: BSON
-
Labels:None
From the issue:
On https://github.com/mongodb/js-bson/blob/master/lib/objectid.js#L87 you allow creating an ObjectId with a string of length 12, which then gets set to this.id – but on https://github.com/mongodb/js-bson/blob/master/lib/objectid.js#L253 it assumes that this.id is a Buffer.
I cannot find anywhere in the code where that would be sanitized; my guess is it doesn't come up much, but that should probably be clarified one way or the other.
—
There are actually several other places in the file which will die a gruesome death if you use a 12 byte string for this.id
Another item from the same file which isn't really a big deal but could be fixed: const decodeLookup should be {} not [] since you're not using it as an array, rather as a dict / map. (the array when you're done currently is not going to have the correct length as it is)