From 382160dfbda4d7c90866191666907155d008f1fb Mon Sep 17 00:00:00 2001
From: Jb Aviat <jb@sqreen.io>
Date: Mon, 12 Mar 2018 17:22:14 +0100
Subject: [PATCH] Add type checking to user callable APIs

---
 .../mini_racer_extension.cc                   | 24 +++++++++++++++++++
 test/mini_racer_test.rb                       | 13 ++++++++++
 2 files changed, 37 insertions(+)

diff --git a/ext/mini_racer_extension/mini_racer_extension.cc b/ext/mini_racer_extension/mini_racer_extension.cc
index a308f71..58dddb9 100644
--- a/ext/mini_racer_extension/mini_racer_extension.cc
+++ b/ext/mini_racer_extension/mini_racer_extension.cc
@@ -81,6 +81,11 @@ static std::mutex platform_lock;
 static VALUE rb_platform_set_flag_as_str(VALUE _klass, VALUE flag_as_str) {
     bool platform_already_initialized = false;
 
+    if(TYPE(flag_as_str) != T_STRING) {
+        rb_raise(rb_eArgError, "wrong type argument %"PRIsVALUE" (should be a string)",
+                rb_obj_class(flag_as_str));
+    }
+
     platform_lock.lock();
 
     if (current_platform == NULL) {
@@ -431,6 +436,11 @@ static VALUE rb_snapshot_load(VALUE self, VALUE str) {
     SnapshotInfo* snapshot_info;
     Data_Get_Struct(self, SnapshotInfo, snapshot_info);
 
+    if(TYPE(str) != T_STRING) {
+        rb_raise(rb_eArgError, "wrong type argument %"PRIsVALUE" (should be a string)",
+                rb_obj_class(str));
+    }
+
     init_v8();
 
     StartupData startup_data = V8::CreateSnapshotDataBlob(RSTRING_PTR(str));
@@ -449,6 +459,11 @@ static VALUE rb_snapshot_warmup(VALUE self, VALUE str) {
     SnapshotInfo* snapshot_info;
     Data_Get_Struct(self, SnapshotInfo, snapshot_info);
 
+    if(TYPE(str) != T_STRING) {
+        rb_raise(rb_eArgError, "wrong type argument %"PRIsVALUE" (should be a string)",
+                rb_obj_class(str));
+    }
+
     init_v8();
 
     StartupData cold_startup_data = {snapshot_info->data, snapshot_info->raw_size};
@@ -552,6 +567,15 @@ static VALUE rb_context_eval_unsafe(VALUE self, VALUE str, VALUE filename) {
     Data_Get_Struct(self, ContextInfo, context_info);
     Isolate* isolate = context_info->isolate_info->isolate;
 
+    if(TYPE(str) != T_STRING) {
+        rb_raise(rb_eArgError, "wrong type argument %"PRIsVALUE" (should be a string)",
+                rb_obj_class(str));
+    }
+    if(filename != Qnil && TYPE(filename) != T_STRING) {
+        rb_raise(rb_eArgError, "wrong type argument %"PRIsVALUE" (should be nil or a string)",
+                rb_obj_class(filename));
+    }
+
     {
 	Locker lock(isolate);
 	Isolate::Scope isolate_scope(isolate);
diff --git a/test/mini_racer_test.rb b/test/mini_racer_test.rb
index 53a08a0..a9eef2b 100644
--- a/test/mini_racer_test.rb
+++ b/test/mini_racer_test.rb
@@ -33,6 +33,13 @@ class MiniRacerTest < Minitest::Test
     assert_nil context.eval('undefined')
   end
 
+  def test_compile_nil_context
+    context = MiniRacer::Context.new
+    assert_raises(ArgumentError) do
+        assert_equal 2, context.eval(nil)
+    end
+  end
+
   def test_array
     context = MiniRacer::Context.new
     assert_equal [1,"two"], context.eval('[1,"two"]')
@@ -398,6 +405,12 @@ raise FooError, "I like foos"
     end
   end
 
+  def test_invalid_warmup_sources_throw_an_exception
+    assert_raises(ArgumentError) do
+      MiniRacer::Snapshot.new('function f() { return 1 }').warmup!([])
+    end
+  end
+
   def test_warming_up_with_invalid_source_does_not_affect_the_snapshot_internal_state
     snapshot = MiniRacer::Snapshot.new('Math.sin = 1;')