diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c98072..a2edc51 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,2 +1,19 @@
+## [3.3.3](https://github.com/Automattic/socket.io-parser/compare/3.3.2...3.3.3) (2022-11-09)
+
+
+### Bug Fixes
+
+* check the format of the index of each attachment ([fb21e42](https://github.com/Automattic/socket.io-parser/commit/fb21e422fc193b34347395a33e0f625bebc09983))
+
+
+
+## [3.3.2](https://github.com/Automattic/socket.io-parser/compare/3.3.1...3.3.2) (2021-01-09)
+
+
+### Bug Fixes
+
+* prevent DoS (OOM) via massive packets ([#95](https://github.com/Automattic/socket.io-parser/issues/95)) ([89197a0](https://github.com/Automattic/socket.io-parser/commit/89197a05c43b18cc4569fd178d56e7bb8f403865))
+
+
## [3.3.1](https://github.com/socketio/socket.io-parser/compare/3.3.0...3.3.1) (2020-09-30)
diff --git a/binary.js b/binary.js
index 3e2347d..95a1450 100644
--- a/binary.js
+++ b/binary.js
@@ -70,8 +70,16 @@ exports.reconstructPacket = function(packet, buffers) {
function _reconstructPacket(data, buffers) {
if (!data) return data;
- if (data && data._placeholder) {
- return buffers[data.num]; // appropriate buffer (should be natural order anyway)
+ if (data && data._placeholder === true) {
+ var isIndexValid =
+ typeof data.num === "number" &&
+ data.num >= 0 &&
+ data.num < buffers.length;
+ if (isIndexValid) {
+ return buffers[data.num]; // appropriate buffer (should be natural order anyway)
+ } else {
+ throw new Error("illegal attachments");
+ }
} else if (isArray(data)) {
for (var i = 0; i < data.length; i++) {
data[i] = _reconstructPacket(data[i], buffers);
diff --git a/index.js b/index.js
index 102615a..245a800 100644
--- a/index.js
+++ b/index.js
@@ -239,6 +239,9 @@ Emitter(Decoder.prototype);
Decoder.prototype.add = function(obj) {
var packet;
if (typeof obj === 'string') {
+ if (this.reconstructor) {
+ throw new Error("got plaintext data when reconstructing a packet");
+ }
packet = decodeString(obj);
if (exports.BINARY_EVENT === packet.type || exports.BINARY_ACK === packet.type) { // binary packet's json
this.reconstructor = new BinaryReconstructor(packet);
@@ -286,11 +289,9 @@ function decodeString(str) {
// look up attachments if type binary
if (exports.BINARY_EVENT === p.type || exports.BINARY_ACK === p.type) {
- var buf = '';
- while (str.charAt(++i) !== '-') {
- buf += str.charAt(i);
- if (i == str.length) break;
- }
+ var start = i + 1;
+ while (str.charAt(++i) !== '-' && i != str.length) {}
+ var buf = str.substring(start, i);
if (buf != Number(buf) || str.charAt(i) !== '-') {
throw new Error('Illegal attachments');
}
@@ -299,13 +300,13 @@ function decodeString(str) {
// look up namespace (if any)
if ('/' === str.charAt(i + 1)) {
- p.nsp = '';
+ var start = i + 1;
while (++i) {
var c = str.charAt(i);
if (',' === c) break;
- p.nsp += c;
if (i === str.length) break;
}
+ p.nsp = str.substring(start, i);
} else {
p.nsp = '/';
}
@@ -313,17 +314,16 @@ function decodeString(str) {
// look up id
var next = str.charAt(i + 1);
if ('' !== next && Number(next) == next) {
- p.id = '';
+ var start = i + 1;
while (++i) {
var c = str.charAt(i);
if (null == c || Number(c) != c) {
--i;
break;
}
- p.id += str.charAt(i);
if (i === str.length) break;
}
- p.id = Number(p.id);
+ p.id = Number(str.substring(start, i + 1));
}
// look up json data
diff --git a/package-lock.json b/package-lock.json
index 6718338..e7cdf10 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,6 +1,6 @@
{
"name": "socket.io-parser",
- "version": "3.3.1",
+ "version": "3.3.2",
"lockfileVersion": 1,
"requires": true,
"dependencies": {
diff --git a/package.json b/package.json
index 3b39d68..9414417 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "socket.io-parser",
- "version": "3.3.1",
+ "version": "3.3.3",
"description": "socket.io protocol parser",
"repository": {
"type": "git",
diff --git a/test/buffer.js b/test/buffer.js
index 3aba898..f18e68a 100644
--- a/test/buffer.js
+++ b/test/buffer.js
@@ -1,8 +1,7 @@
var parser = require('../index.js');
var expect = require('expect.js');
var helpers = require('./helpers.js');
-var encode = parser.encode;
-var decode = parser.decode;
+var Decoder = parser.Decoder;
describe('parser', function() {
it('encodes a Buffer', function() {
@@ -14,6 +13,15 @@ describe('parser', function() {
});
});
+ it("encodes a nested Buffer", function() {
+ helpers.test_bin({
+ type: parser.BINARY_EVENT,
+ data: ["a", { b: ["c", Buffer.from("abc", "utf8")] }],
+ id: 23,
+ nsp: "/cool",
+ });
+ });
+
it('encodes a binary ack with Buffer', function() {
helpers.test_bin({
type: parser.BINARY_ACK,
@@ -22,4 +30,39 @@ describe('parser', function() {
nsp: '/back'
})
});
+
+ it("throws an error when adding an attachment with an invalid 'num' attribute (string)", function() {
+ var decoder = new Decoder();
+
+ expect(function() {
+ decoder.add('51-["hello",{"_placeholder":true,"num":"splice"}]');
+ decoder.add(Buffer.from("world"));
+ }).to.throwException(/^illegal attachments$/);
+ });
+
+ it("throws an error when adding an attachment with an invalid 'num' attribute (out-of-bound)", function() {
+ var decoder = new Decoder();
+
+ expect(function() {
+ decoder.add('51-["hello",{"_placeholder":true,"num":1}]');
+ decoder.add(Buffer.from("world"));
+ }).to.throwException(/^illegal attachments$/);
+ });
+
+ it("throws an error when adding an attachment without header", function() {
+ var decoder = new Decoder();
+
+ expect(function() {
+ decoder.add(Buffer.from("world"));
+ }).to.throwException(/^got binary data when not reconstructing a packet$/);
+ });
+
+ it("throws an error when decoding a binary event without attachments", function() {
+ var decoder = new Decoder();
+
+ expect(function() {
+ decoder.add('51-["hello",{"_placeholder":true,"num":0}]');
+ decoder.add('2["hello"]');
+ }).to.throwException(/^got plaintext data when reconstructing a packet$/);
+ });
});
pFad - Phonifier reborn
Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.
Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.
Alternative Proxies:
Alternative Proxy
pFad Proxy
pFad v3 Proxy
pFad v4 Proxy