taler-typescript-core

commit 5937bc80d001212269e984a12a86df5e54227922
parent 042a65518772484f83b60f923fc09474cf7cac26
Author: Florian Dold <dold@taler.net>
Date:   Tue, 19 May 2026 23:24:31 +0200

idb-bridge: validate key on update via cursor

Diffstat:
M
packages/idb-bridge/src/bridge-idb.ts
 | 
8
++++++++

1 file changed, 8 insertions(+), 0 deletions(-)
diff --git a/packages/idb-bridge/src/bridge-idb.ts b/packages/idb-bridge/src/bridge-idb.ts
@@ -48,6 +48,7 @@ import {
 } from "./idbtypes.js";
 import { canInjectKey } from "./util/canInjectKey.js";
 import { compareKeys } from "./util/cmp.js";
+import { extractKey } from "./util/extractKey.js";
 import { enforceRange } from "./util/enforceRange.js";
 import {
   AbortError,
@@ -329,6 +330,13 @@ export class BridgeIDBCursor implements IDBCursor {
       throw new DataCloneError();
     }
 
+    if (os._objectStoreMeta.keyPath !== null) {
+      const key2 = extractKey(os._objectStoreMeta.keyPath, value);
+      if (compareKeys(key, key2) !== 0) {
+        throw new DataError();
+      }
+    }
+
     if (os.keyPath !== null && os.keyPath !== undefined) {
       if (!canInjectKey(os.keyPath, value)) {
         throw new DataError();