From b1ebb0d8ca9e0f4e38de4d072fbdf97d1ee6396d Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 29 Sep 2024 11:51:10 +0200
Subject: [PATCH] buffer: coerce extrema to int in `blob.slice`

PR-URL: https://github.com/nodejs/node/pull/55141
Fixes: https://github.com/nodejs/node/issues/55139
Reviewed-By: Benjamin Gruenbaum <benjamingr@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 lib/internal/blob.js       | 7 +++++++
 test/parallel/test-blob.js | 1 +
 2 files changed, 8 insertions(+)

diff --git a/lib/internal/blob.js b/lib/internal/blob.js
index 4d443c80278385..af26a1bb7536b4 100644
--- a/lib/internal/blob.js
+++ b/lib/internal/blob.js
@@ -54,6 +54,7 @@ const {
   lazyDOMException,
 } = require('internal/util');
 const { inspect } = require('internal/util/inspect');
+const { convertToInt } = require('internal/webidl');
 
 const {
   codes: {
@@ -239,6 +240,12 @@ class Blob {
   slice(start = 0, end = this[kLength], contentType = '') {
     if (!isBlob(this))
       throw new ERR_INVALID_THIS('Blob');
+
+    // Coerce values to int
+    const opts = { __proto__: null, signed: true };
+    start = convertToInt('start', start, 64, opts);
+    end = convertToInt('end', end, 64, opts);
+
     if (start < 0) {
       start = MathMax(this[kLength] + start, 0);
     } else {
diff --git a/test/parallel/test-blob.js b/test/parallel/test-blob.js
index e7332606f64c28..bcf88699b2910c 100644
--- a/test/parallel/test-blob.js
+++ b/test/parallel/test-blob.js
@@ -483,6 +483,7 @@ assert.throws(() => new Blob({}), {
 
   assert.ok(blob.slice(0, 1).constructor === Blob);
   assert.ok(blob.slice(0, 1) instanceof Blob);
+  assert.ok(blob.slice(0, 1.5) instanceof Blob);
 }
 
 (async () => {