fix(vnext): validate parser array lengths

Author: Light2Dark

src/vnext/__tests__/node-sql-parser-backend.test.ts

@@ -569,6 +569,32 @@ describe("node-sql-parser backend output decoding", () => {
     });
   });
 
+  it.each(["1", Number.NaN, -1, 1.5, Number.MAX_SAFE_INTEGER + 1])(
+    "rejects an array with a spoofed length descriptor %#",
+    async (length) => {
+      const root = new Proxy([{ type: "select" }], {
+        getOwnPropertyDescriptor(target, key) {
+          if (key === "length") {
+            return {
+              configurable: false,
+              enumerable: false,
+              value: length,
+              writable: true,
+            };
+          }
+          return Reflect.getOwnPropertyDescriptor(target, key);
+        },
+      });
+      const backend = backendFor(() => root);
+
+      await expect(backend.parse("SELECT 1")).resolves.toStrictEqual({
+        code: "malformed-output",
+        kind: "failed",
+        retryable: false,
+      });
+    },
+  );
+
   it("does not invoke an accessor-backed root type", async () => {
     let invoked = false;
     const root = {};

src/vnext/node-sql-parser-backend.ts

@@ -255,7 +255,11 @@ function decodeRoot(
   }
   if (rootIsArray && isRecordObject(root)) {
     const length = readOwnDataProperty(root, "length");
-    if (length.kind !== "value") {
+    if (
+      length.kind !== "value" ||
+      !Number.isSafeInteger(length.value) ||
+      Number(length.value) < 0
+    ) {
       return failed("malformed-output", false);
     }
     if (length.value !== 1) {