Release 0.9.7

Prevent crash when socket leaves a room twice.

History.md

@@ -1,4 +1,35 @@
 
+0.9.7 / 2012-07-24
+==================
+
+  * Prevent crash when socket leaves a room twice.
+  * Corrects unsafe usage of for..in
+  * Fix for node 0.8 with `gzip compression` [vadimi]
+  * Update redis to support Node 0.8.x
+  * Made ID generation securely random
+  * Fix Redis Store race condition in manager onOpen unsubscribe callback
+  * Fix for EventEmitters always reusing the same Array instance for listeners
+
+0.9.6 / 2012-04-17
+==================
+
+  * Fixed XSS in jsonp-polling.
+
+0.9.5 / 2012-04-05
+==================
+
+  * Added test for polling and socket close.
+  * Ensure close upon request close.
+  * Fix disconnection reason being lost for polling transports.
+  * Ensure that polling transports work with Connection: close.
+  * Log disconnection reason.
+
+0.9.4 / 2012-04-01
+==================
+
+  * Disconnecting from namespace improvement (#795) [DanielBaulig]
+  * Bumped client with polling reconnection loop (#438)
+
 0.9.3 / 2012-03-28
 ==================
 

Readme.md

@@ -6,7 +6,9 @@ horizontal scalability, automatic JSON encoding/decoding, and more.
 
 ## How to Install
 
-    npm install socket.io
+```bash
+npm install socket.io
+```
 
 ## How to use
 
@@ -102,10 +104,10 @@ io.sockets.on('connection', function (socket) {
   var socket = io.connect('http://localhost');
 
   socket.on('connect', function () {
-    socket.emit('set nickname', confirm('What is your nickname?'));
+    socket.emit('set nickname', prompt('What is your nickname?'));
     socket.on('ready', function () {
       console.log('Connected !');
-      socket.emit('msg', confirm('What is your message?'));
+      socket.emit('msg', prompt('What is your message?'));
     });
   });
 </script>

lib/manager.js

@@ -11,6 +11,7 @@
 var fs = require('fs')
   , url = require('url')
   , tty = require('tty')
+  , crypto = require('crypto')
   , util = require('./util')
   , store = require('./store')
   , client = require('socket.io-client')
@@ -44,7 +45,8 @@ var defaultTransports = exports.defaultTransports = [
  */
 
 var parent = module.parent.exports
-  , protocol = parent.protocol;
+  , protocol = parent.protocol
+  , jsonpolling_re = /^\d+$/;
 
 /**
  * Manager constructor.
@@ -91,7 +93,9 @@ function Manager (server, options) {
   };
 
   for (var i in options) {
-    this.settings[i] = options[i];
+    if (options.hasOwnProperty(i)) {
+      this.settings[i] = options[i];
+    }
   }
 
   var self = this;
@@ -108,8 +112,7 @@ function Manager (server, options) {
   });
 
   // reset listeners
-  this.oldListeners = server.listeners('request');
-  server.removeAllListeners('request');
+  this.oldListeners = server.listeners('request').splice(0);
 
   server.on('request', function (req, res) {
     self.handleRequest(req, res);
@@ -128,8 +131,10 @@ function Manager (server, options) {
   });
 
   for (var i in transports) {
-    if (transports[i].init) {
-      transports[i].init(this);
+    if (transports.hasOwnProperty(i)) {
+      if (transports[i].init) {
+        transports[i].init(this);
+      }
     }
   }
 
@@ -139,6 +144,8 @@ function Manager (server, options) {
     self.emit('connection', conn);
   });
 
+  this.sequenceNumber = Date.now() | 0;
+ 
   this.log.info('socket.io started');
 };
 
@@ -343,12 +350,21 @@ Manager.prototype.onConnect = function (id) {
 Manager.prototype.onOpen = function (id) {
   this.open[id] = true;
 
-  // if we were buffering messages for the client, clear them
   if (this.closed[id]) {
     var self = this;
 
     this.store.unsubscribe('dispatch:' + id, function () {
-      delete self.closed[id];
+      var transport = self.transports[id];
+      if (self.closed[id] && self.closed[id].length && transport) {
+
+        // if we have buffered messages that accumulate between calling
+        // onOpen an this async callback, send them if the transport is 
+        // still open, otherwise leave them buffered
+        if (transport.open) {
+          transport.payload(self.closed[id]);
+          self.closed[id] = [];
+        }
+      }
     });
   }
 
@@ -419,7 +435,10 @@ Manager.prototype.onLeave = function (id, room) {
     if (!this.rooms[room].length) {
       delete this.rooms[room];
     }
-    delete this.roomClients[id][room];
+
+    if (this.roomClients[id]) {
+      delete this.roomClients[id][room];
+    }
   }
 };
 
@@ -477,8 +496,10 @@ Manager.prototype.onClientMessage = function (id, packet) {
 
 Manager.prototype.onClientDisconnect = function (id, reason) {
   for (var name in this.namespaces) {
-    this.namespaces[name].handleDisconnect(id, reason, typeof this.roomClients[id] !== 'undefined' &&
-      typeof this.roomClients[id][name] !== 'undefined');
+    if (this.namespaces.hasOwnProperty(name)) {
+      this.namespaces[name].handleDisconnect(id, reason, typeof this.roomClients[id] !== 'undefined' &&
+        typeof this.roomClients[id][name] !== 'undefined');
+    }
   }
 
   this.onDisconnect(id);
@@ -512,7 +533,9 @@ Manager.prototype.onDisconnect = function (id, local) {
 
   if (this.roomClients[id]) {
     for (var room in this.roomClients[id]) {
-      this.onLeave(id, room);
+      if (this.roomClients[id].hasOwnProperty(room)) {
+        this.onLeave(id, room);
+      }
     }
     delete this.roomClients[id]
   }
@@ -662,11 +685,13 @@ Manager.prototype.handleClient = function (data, req) {
 
       // initialize the socket for all namespaces
       for (var i in this.namespaces) {
-        var socket = this.namespaces[i].socket(data.id, true);
+        if (this.namespaces.hasOwnProperty(i)) {
+          var socket = this.namespaces[i].socket(data.id, true);
 
-        // echo back connect packet and fire connection event
-        if (i === '') {
-          this.namespaces[i].handlePacket(data.id, { type: 'connect' });
+          // echo back connect packet and fire connection event
+          if (i === '') {
+            this.namespaces[i].handlePacket(data.id, { type: 'connect' });
+          }
         }
       }
 
@@ -694,8 +719,18 @@ Manager.prototype.handleClient = function (data, req) {
  */
 
 Manager.prototype.generateId = function () {
-  return Math.abs(Math.random() * Math.random() * Date.now() | 0).toString()
-    + Math.abs(Math.random() * Math.random() * Date.now() | 0).toString();
+  var rand = new Buffer(15); // multiple of 3 for base64
+  this.sequenceNumber = (this.sequenceNumber + 1) | 0;
+  rand.writeInt32BE(this.sequenceNumber, 11);
+  if (crypto.randomBytes) {
+    crypto.randomBytes(12).copy(rand);
+  } else {
+    // not secure for node 0.4
+    [0, 4, 8].forEach(function(i) {
+      rand.writeInt32BE(Math.random() * Math.pow(2, 32) | 0, i);
+    });
+  }
+  return rand.toString('base64').replace(/\//g, '_').replace(/\+/g, '-');
 };
 
 /**
@@ -712,7 +747,7 @@ Manager.prototype.handleHandshake = function (data, req, res) {
     };
 
   function writeErr (status, message) {
-    if (data.query.jsonp) {
+    if (data.query.jsonp && jsonpolling_re.test(data.query.jsonp)) {
       res.writeHead(200, { 'Content-Type': 'application/javascript' });
       res.end('io.j[' + data.query.jsonp + '](new Error("' + message + '"));');
     } else {
@@ -751,7 +786,7 @@ Manager.prototype.handleHandshake = function (data, req, res) {
             , self.transports(data).join(',')
           ].join(':');
 
-      if (data.query.jsonp) {
+      if (data.query.jsonp && jsonpolling_re.test(data.query.jsonp)) {
         hs = 'io.j[' + data.query.jsonp + '](' + JSON.stringify(hs) + ');';
         res.writeHead(200, { 'Content-Type': 'application/javascript' });
       } else {

lib/socket.io.js

@@ -15,7 +15,7 @@ var client = require('socket.io-client');
  * Version.
  */
 
-exports.version = '0.9.3';
+exports.version = '0.9.5';
 
 /**
  * Supported protocol version.

lib/socket.js

@@ -291,12 +291,19 @@ Socket.prototype.disconnect = function () {
   if (!this.disconnected) {
     this.log.info('booting client');
 
-    if (this.manager.transports[this.id] && this.manager.transports[this.id].open) {
-      this.manager.transports[this.id].onForcedDisconnect();
+    if ('' === this.namespace.name) {
+      if (this.manager.transports[this.id] && this.manager.transports[this.id].open) {
+        this.manager.transports[this.id].onForcedDisconnect();
+      } else {
+        this.manager.onClientDisconnect(this.id);
+        this.manager.store.publish('disconnect:' + this.id);
+      }
     } else {
-      this.manager.onClientDisconnect(this.id);
-      this.manager.store.publish('disconnect:' + this.id);
+      this.packet({type: 'disconnect'});
+      this.manager.onLeave(this.id, this.namespace.name);
+      this.$emit('disconnect', 'booted');
     }
+
   }
 
   return this;

lib/static.js

@@ -178,7 +178,7 @@ Static.prototype.gzip = function (data, callback) {
     buffer.length = 0;
   });
 
-  gzip.on('exit', function () {
+  gzip.on('close', function () {
     if (err) return callback(err);
 
     var size = 0

lib/transport.js

@@ -455,7 +455,7 @@ Transport.prototype.onClose = function () {
 
 Transport.prototype.end = function (reason) {
   if (!this.disconnected) {
-    this.log.info('transport end');
+    this.log.info('transport end (' + reason + ')');
 
     var local = this.manager.transports[this.id];
 

lib/transports/http-polling.js

@@ -43,6 +43,18 @@ HTTPPolling.prototype.__proto__ = HTTPTransport.prototype;
 
 HTTPPolling.prototype.name = 'httppolling';
 
+/**
+ * Override setHandlers
+ *
+ * @api private
+ */
+
+HTTPPolling.prototype.setHandlers = function () {
+  HTTPTransport.prototype.setHandlers.call(this);
+  this.socket.removeListener('end', this.bound.end);
+  this.socket.removeListener('close', this.bound.close);
+};
+
 /**
  * Removes heartbeat timeouts for polling.
  */
@@ -128,8 +140,8 @@ HTTPPolling.prototype.write = function (data, close) {
  * @api private
  */
 
-HTTPPolling.prototype.end = function () {
+HTTPPolling.prototype.end = function (reason) {
   this.clearPollTimeout();
-  return HTTPTransport.prototype.end.call(this);
+  return HTTPTransport.prototype.end.call(this, reason);
 };
 

lib/transports/http.js

@@ -68,6 +68,7 @@ HTTPTransport.prototype.handleRequest = function (req) {
     // prevent memory leaks for uncompleted requests
     req.on('close', function () {
       buffer = '';
+      self.onClose();
     });
 
     if (origin) {

lib/transports/jsonp-polling.js

@@ -10,6 +10,7 @@
  */
 
 var HTTPPolling = require('./http-polling');
+var jsonpolling_re = /^\d+$/
 
 /**
  * Export the constructor.
@@ -29,7 +30,7 @@ function JSONPPolling (mng, data, req) {
   this.head = 'io.j[0](';
   this.foot = ');';
 
-  if (data.query.i) {
+  if (data.query.i && jsonpolling_re.test(data.query.i)) {
     this.head = 'io.j[' + data.query.i + '](';
   }
 };

lib/transports/websocket/default.js

@@ -1,4 +1,3 @@
-
 /*!
  * socket.io-node
  * Copyright(c) 2011 LearnBoost <dev@learnboost.com>
@@ -89,11 +88,14 @@ WebSocket.prototype.onSocketConnect = function () {
   }
 
   var origin = this.req.headers['origin']
-    , location = ((this.manager.settings['match origin protocol'] ?
-                      origin.match(/^https/) : this.socket.encrypted) ?
-                        'wss' : 'ws')
-               + '://' + this.req.headers.host + this.req.url
-    , waitingForNonce = false;
+  , waitingForNonce = false;
+  if(this.manager.settings['match origin protocol']){
+    location = (origin.indexOf('https')>-1 ? 'wss' : 'ws') + '://' + this.req.headers.host + this.req.url;
+  }else if(this.socket.encrypted){
+    location = 'wss://' + this.req.headers.host + this.req.url;
+  }else{
+    location = 'ws://' + this.req.headers.host + this.req.url;
+  }
 
   if (this.req.headers['sec-websocket-key1']) {
     // If we don't have the nonce yet, wait for it (HAProxy compatibility).

lib/transports/websocket/hybi-16.js

@@ -1,4 +1,3 @@
-
 /*!
  * socket.io-node
  * Copyright(c) 2011 LearnBoost <dev@learnboost.com>
@@ -98,7 +97,7 @@ WebSocket.prototype.onSocketConnect = function () {
     return;
   }
 
-  var origin = this.req.headers['origin']
+  var origin = this.req.headers['origin'] || ''
     , location = ((this.manager.settings['match origin protocol'] ?
                       origin.match(/^https/) : this.socket.encrypted) ?
                         'wss' : 'ws')

package.json

@@ -1,6 +1,6 @@
 {
     "name": "socket.io"
-  , "version": "0.9.3"
+  , "version": "0.9.7"
   , "description": "Real-time apps made cross-browser & easy with a WebSocket-like API"
   , "homepage": "http://socket.io"
   , "keywords": ["websocket", "socket", "realtime", "socket.io", "comet", "ajax"]
@@ -16,13 +16,13 @@
       , "url": "https://github.com/LearnBoost/socket.io.git"
     }
   , "dependencies": {
-        "socket.io-client": "0.9.3"
+        "socket.io-client": "0.9.7"
       , "policyfile": "0.0.4"
-      , "redis": "0.6.7"
+      , "redis": "0.7.2"
     }
   , "devDependencies": {
         "expresso": "0.9.2"
-      , "should": "0.0.4"
+      , "should": "*"
       , "benchmark": "0.2.2"
       , "microtime": "0.1.3-1"
       , "colors": "0.5.1"

test/common.js

@@ -103,7 +103,11 @@ HTTPClient.prototype.end = function () {
   Object.keys(this.agent.sockets).forEach(function (socket) {
     for (var i = 0, l = self.agent.sockets[socket].length; i < l; ++i) {
       if (self.agent.sockets[socket][i]._handle) {
-        self.agent.sockets[socket][i]._handle.socket.end();
+        if (self.agent.sockets[socket][i]._handle.socket) {
+          self.agent.sockets[socket][i]._handle.socket.end();
+        } else {
+          self.agent.sockets[socket][i]._handle.owner.end();
+        }
       }
     }
   });

test/namespace.test.js

@@ -282,5 +282,46 @@ module.exports = {
         }
       });
     });
+  },
+  'disconnecting from namespace only': function (done) {
+    var cl = client(++ports)
+      , io = create(cl)
+      , ws1
+      , ws2;
+
+    io.of('/foo').on('connection', function (socket) {
+      socket.disconnect();
+    });
+
+    cl.handshake(function (sid) {
+      ws1 = websocket(cl, sid);
+      ws1.on('open', function () {
+        ws1.packet({
+            type: 'connect'
+          , endpoint: '/bar'
+        });
+        cl.handshake(function (sid) {
+          ws2 = websocket(cl, sid);
+          ws2.on('open', function () {
+            ws2.packet({
+                type: 'connect'
+              , endpoint: '/foo'
+            });
+          });
+          ws2.on('message', function (data) {
+            if ('disconnect' === data.type) {
+              cl.end();
+              ws1.finishClose();
+              ws2.finishClose();
+              io.server.close();
+
+              data.endpoint.should.eql('/foo');
+
+              done();
+            }
+          });
+        });
+      });
+    });
   }
 };

test/parser.test.js

@@ -95,7 +95,7 @@ module.exports = {
   'decoding json packet with message id and ack data': function () {
     parser.decodePacket('4:1+::{"a":"b"}').should.eql({
         type: 'json'
-      , id: 1
+      , id: '1'
       , ack: 'data'
       , endpoint: ''
       , data: { a: 'b' }
@@ -114,7 +114,7 @@ module.exports = {
   'decoding an event packet with message id and ack': function () {
     parser.decodePacket('5:1+::{"name":"tobi"}').should.eql({
         type: 'event'
-      , id: 1
+      , id: '1'
       , ack: 'data'
       , endpoint: ''
       , name: 'tobi'
@@ -143,7 +143,7 @@ module.exports = {
   'decoding a message packet with id and endpoint': function () {
     parser.decodePacket('3:5:/tobi').should.eql({
         type: 'message'
-      , id: 5
+      , id: '5'
       , ack: true
       , endpoint: '/tobi'
       , data: ''
@@ -245,7 +245,7 @@ module.exports = {
   'encoding json packet with message id and ack data': function () {
     parser.encodePacket({
         type: 'json'
-      , id: 1
+      , id: '1'
       , ack: 'data'
       , endpoint: ''
       , data: { a: 'b' }
@@ -264,7 +264,7 @@ module.exports = {
   'encoding an event packet with message id and ack': function () {
     parser.encodePacket({
         type: 'event'
-      , id: 1
+      , id: '1'
       , ack: 'data'
       , endpoint: ''
       , name: 'tobi'
@@ -292,7 +292,7 @@ module.exports = {
   'encoding a message packet with id and endpoint': function () {
     parser.encodePacket({
         type: 'message'
-      , id: 5
+      , id: '5'
       , ack: true
       , endpoint: '/tobi'
       , data: ''

test/static.test.js

@@ -452,7 +452,7 @@ module.exports = {
 
     cl.get('/socket.io/socket.io.js', function (res, data) {
       res.headers['content-type'].should.eql('application/javascript');
-      res.headers['content-length'].should.eql(13);
+      res.headers['content-length'].should.eql('13');
       res.headers.etag.should.eql('1.0');
 
       data.should.eql('custom_client');

test/transports.flashsocket.test.js

@@ -104,7 +104,7 @@ module.exports = {
     netConnection(port, function (err, data){
       should.strictEqual(err, null);
 
-      data.toString().should.include.string('<cross-domain-policy>');
+      data.toString().should.match(/<cross-domain-policy>/);
 
       this.destroy();
       io.flashPolicyServer.close();
@@ -133,7 +133,7 @@ module.exports = {
       netConnection(next, function (err, data){
         should.strictEqual(err, null);
 
-        data.toString().should.include.string('<cross-domain-policy>');
+        data.toString().should.match(/<cross-domain-policy>/);
 
         this.destroy();
         io.flashPolicyServer.close();
@@ -159,7 +159,7 @@ module.exports = {
     server.origins.should.not.contain('google.com:80');
     server.origins.should.contain('foo.bar:80');
     server.origins.should.contain('socket.io:1337');
-    server.buffer.toString('utf8').should.include.string('socket.io');
+    server.buffer.toString('utf8').should.match(/socket\.io/);
 
     io.flashPolicyServer.close();
     done();

test/transports.jsonp-polling.test.js

@@ -257,7 +257,7 @@ module.exports = {
       , sid;
 
     io.configure(function () {
-      io.set('close timeout', .05);
+      io.set('close timeout', .1);
     });
 
     io.sockets.on('connection', function (socket) {
@@ -625,7 +625,7 @@ module.exports = {
 
     io.configure(function () {
       io.set('polling duration', .2);
-      io.set('close timeout', .2);
+      io.set('close timeout', .5);
     });
 
     io.sockets.on('connection', function (socket) {

test/transports.xhr-polling.test.js

@@ -289,6 +289,40 @@ module.exports = {
     });
   },
 
+  'test that connection close does not mean disconnect': function (done) {
+    var cl = client(++ports)
+      , io = create(cl)
+      , sid
+      , end
+      , disconnected = false
+
+    io.configure(function () {
+      io.set('polling duration', .2);
+      io.set('close timeout', .5);
+    });
+
+    io.sockets.on('connection', function (client) {
+      end = function () {
+        cl.end();
+        console.log('ending');
+        client.on('disconnect', function () {
+          disconnected = true;
+        });
+      }
+    });
+
+    cl.handshake(function (sid) {
+      cl.get('/socket.io/{protocol}/xhr-polling/' + sid);
+      setTimeout(end, 30);
+      setTimeout(function () {
+        console.log('finished');
+        disconnected.should.be.false;
+        io.server.close();
+        done();
+      }, 100);
+    });
+  },
+
   'test sending back data': function (done) {
     var cl = client(++ports)
       , io = create(cl);
@@ -1317,7 +1351,7 @@ module.exports = {
                     msgs.should.have.length(1);
                     msgs[0].should.eql({
                         type: 'ack'
-                      , ackId: 1
+                      , ackId: '1'
                       , endpoint: ''
                       , args: []
                     });