{"record":{"id":"973106d73e1c4460","repo":"usebruno/bruno","slug":"getrandomvalues-arraybufferview-byte-length-excee","errorCode":null,"errorMessage":"getRandomValues: ArrayBufferView byte length exceeds 65536","messagePattern":"getRandomValues: ArrayBufferView byte length exceeds 65536","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/bruno-js/src/sandbox/quickjs/shims/lib/crypto-utils.js","lineNumber":56,"sourceCode":"      const vmError = vm.newError(error.message);\n      vm.setProp(vmError, 'name', vm.newString(error.name));\n\n      throw vmError;\n    }\n  });\n\n  let getRandomValuesHandle = vm.newFunction('getRandomValues', function (arrayHandle) {\n    try {\n      // Receive the serialized array data directly\n      const serializedArray = vm.dump(arrayHandle);\n      const typedArray = deserializeTypedArray(serializedArray);\n\n      if (typedArray.length === 0) {\n        return marshallToVm([], vm);\n      }\n\n      if (typedArray.length > 65536) {\n        throw new Error('getRandomValues: ArrayBufferView byte length exceeds 65536');\n      }\n\n      crypto.getRandomValues(typedArray);\n\n      const byteArray = Array.from(typedArray);\n\n      return marshallToVm(byteArray, vm);\n    } catch (error) {\n      const vmError = vm.newError(error.message);\n      vm.setProp(vmError, 'name', vm.newString(error.name));\n\n      throw vmError;\n    }\n  });\n\n  // Set the functions in global context\n  vm.setProp(vm.global, '__bruno__crypto__randomBytes', randomBytesHandle);\n  vm.setProp(vm.global, '__bruno__crypto__getRandomValues', getRandomValuesHandle);","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/usebruno/bruno/blob/9bdd81c7bdc57006e5f5ebffb79321a8d979f712/packages/bruno-js/src/sandbox/quickjs/shims/lib/crypto-utils.js#L38-L74","documentation":"Thrown by the QuickJS sandbox crypto shim for crypto.getRandomValues when the supplied typed array's length exceeds 65536 bytes. The Web Crypto spec (and browsers) cap crypto.getRandomValues at 65536 bytes; the shim enforces the same cap. The input is deserialized from the sandbox before the check.","triggerScenarios":"Calling crypto.getRandomValues(new Uint8Array(70000)) or any typed array whose byte length exceeds 65536 inside a QuickJS-sandboxed Bru script.","commonSituations":"Generating a large nonce, IV, or salt with an unbounded length; passing the whole payload buffer instead of a fixed-size nonce; reusing a buffer sized from a response field.","solutions":["Allocate a typed array of <= 65536 bytes: `crypto.getRandomValues(new Uint8Array(32))`.","If more randomness is required, fill in chunks across multiple calls.","Cap the length from untrusted sources: `new Uint8Array(Math.min(n, 65536))`."],"exampleFix":"// before\ncrypto.getRandomValues(new Uint8Array(100000));\n\n// after\nconst buf = new Uint8Array(32);\ncrypto.getRandomValues(buf);","handlingStrategy":"validation","validationCode":"function safeGetRandomValues(ta) {\n  if (ta.length > 65536) throw new RangeError('typed array too large');\n  return crypto.getRandomValues(ta);\n}","typeGuard":"const isSmallTypedArray = (v) => ArrayBuffer.isView(v) && v.length <= 65536;","tryCatchPattern":"try { crypto.getRandomValues(arr); }\ncatch (err) {\n  if (/exceeds 65536/.test(err.message)) { /* shrink array, retry */ }\n  else throw err;\n}","preventionTips":["Allocate fixed small typed arrays (12-32 bytes) for nonce/IV/salt.","Never pass full request payloads to getRandomValues."],"tags":["bruno-js","quickjs","sandbox","crypto","webcrypto","range"],"backgroundTag":null,"analyzedSha":"9bdd81c7bdc57006e5f5ebffb79321a8d979f712","analyzedAt":"2026-08-13T04:09:25.751Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}