fix collision by proxy number (#328)

Author: artalar

index.js

@@ -23,7 +23,8 @@ let fillPool = bytes => {
 }
 
 let random = bytes => {
-  fillPool(bytes)
+  // `-=` convert `bytes` to number to prevent `valueOf` abusing
+  fillPool((bytes -= 0))
   return pool.subarray(poolOffset - bytes, poolOffset)
 }
 
@@ -65,7 +66,8 @@ let customRandom = (alphabet, size, getRandom) => {
 let customAlphabet = (alphabet, size) => customRandom(alphabet, size, random)
 
 let nanoid = (size = 21) => {
-  fillPool(size)
+  // `-=` convert `size` to number to prevent `valueOf` abusing
+  fillPool((size -= 0))
   let id = ''
   // We are reading directly from the random pool to avoid creating new array
   for (let i = poolOffset - size; i < poolOffset; i++) {

test/index.test.js

@@ -151,5 +151,41 @@ for (let type of ['node', 'browser']) {
         }
       })
     })
+
+    if (type === 'node') {
+      describe('proxy number', () => {
+        it('prevent collision', () => {
+          let makeProxyNumberToReproducePreviousID = () => {
+            let step = 0
+            return {
+              valueOf() {
+                // "if (!pool || pool.length < bytes) {"
+                if (step === 0) {
+                  step++
+                  return 0
+                }
+                // "} else if (poolOffset + bytes > pool.length) {"
+                if (step === 1) {
+                  step++
+                  return -Infinity
+                }
+                // "poolOffset += bytes"
+                if (step === 2) {
+                  step++
+                  return 0
+                }
+
+                return 21
+              }
+            }
+          }
+
+          let ID1 = nanoid()
+          let ID2 = nanoid(makeProxyNumberToReproducePreviousID())
+
+          expect(ID1).not.toBe(ID2)
+        })
+      })
+    }
   })
 }