Skip to content

Serialized snapshot blob maps corrupt arbitrary binary summary blobs #28030

Description

Describe the bug

Container-loader serialized-state paths assume structural snapshot blobs are UTF-8 text. SummaryType.Blob, however, accepts raw Uint8Array content. Arbitrary binary bytes can therefore be corrupted when a summary is converted to a snapshot, serialized through a string-valued blob map, and later rehydrated.

Affected paths include detached-container serialization/rehydration and frozen full-container capture of structural snapshot blobs. Converting invalid UTF-8 bytes to a JavaScript string replaces bytes with U+FFFD; encoding that string later cannot recover the original payload.

This surfaced while reviewing PR #27880. That feature should retain its local base64 workaround rather than expanding scope into the generic loader serialization format.

To Reproduce

Steps to reproduce the behavior:

  1. Create a summary containing SummaryType.Blob with bytes such as Uint8Array([0x00, 0x7f, 0x80, 0xc3, 0x28, 0xff]).
  2. Serialize it through detached-container state or capture it as a structural blob in frozen full-container state.
  3. JSON round-trip and rehydrate the state.
  4. Read the blob and compare it byte-for-byte with the original payload.
  5. Observe replacement-byte sequences where invalid UTF-8 bytes were present.

Expected behavior

Serialized snapshot formats should preserve arbitrary blob bytes. Binary encoding should be explicit at the JSON boundary (for example, a versioned base64 encoding marker), with backward-compatible decoding for existing marker-less UTF-8 states. Paths whose contracts guarantee textual content may continue using UTF-8 explicitly.

Logs

N/A

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions