github/socket.io
1
1
Fork 0
mirror of https://github.com/socketio/socket.io.git synced 2026-04-30 03:00:39 -04:00
Code Issues Packages Projects Releases Wiki Activity
1,110 Commits 24 Branches 210 Tags
088dcb4dff60df39785df13d0a33d3ceaa1dff38
Commit Graph

5 Commits

Author SHA1 Message Date
Jeffrey van Norden
a463d268ed fix(typings): allow CorsOptionsDelegate as cors options (#641) 
Reference: https://www.npmjs.com/package/cors#configuring-cors-asynchronously

Related: 54a59cd8f0
 2022-02-17 06:36:49 +01:00
Damien Arrachequesne
8b4d6a8176 fix(uws): handle invalid websocket upgrades 
When binding to an uWebSockets.js App, there was an unhandled case that
could crash the server:

```
curl "http://localhost:3000/engine.io/?EIO=4&transport=websocket"
```

would result in:

```
Error: Returning from a request handler without responding or attaching an abort handler is forbidden!
terminate called without an active exception
```

Note: this does not apply to the default server based on ws, because
the error was caught elsewhere in the source code.

Related: https://github.com/socketio/socket.io/issues/4250
 2022-01-14 08:18:03 +01:00
Damien Arrachequesne
c0e194d449 fix: properly handle invalid data sent by a malicious websocket client 
**IMPORTANT SECURITY FIX**

A malicious client could send a specially crafted HTTP request,
triggering an uncaught exception and killing the Node.js process:

> RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear
>   at Receiver.getInfo (/.../node_modules/ws/lib/receiver.js:176:14)
>   at Receiver.startLoop (/.../node_modules/ws/lib/receiver.js:136:22)
>   at Receiver._write (/.../node_modules/ws/lib/receiver.js:83:10)
>   at writeOrBuffer (internal/streams/writable.js:358:12)

This bug was introduced by [1], included in `engine.io@4.0.0`, so
previous releases are not impacted.

[1]: f3c291fa61

Thanks to Marcus Wejderot from Mevisio for the responsible disclosure.
 2022-01-11 15:52:15 +01:00
Damien Arrachequesne
271e2df94d feat: add an implementation based on uWebSockets.js 
```js
const { App } = require("uWebSockets.js");
const { uServer } = require("engine.io");

const app = new App();
const server = new uServer();

server.attach(app);

app.listen(3000);
```

Reference: https://github.com/uNetworking/uWebSockets.js

Related: https://github.com/socketio/engine.io/issues/578
 2021-11-02 22:46:09 +01:00
Damien Arrachequesne
c0d6eaa1ba chore: migrate to TypeScript 
Related: https://github.com/socketio/engine.io/issues/510
 2021-10-08 14:55:30 +02:00