Release 0.9.15

History.md

@@ -1,4 +1,19 @@
 
+0.9.15 / 2013-06-06
+===================
+
+  * transports: added escaping to htmlfile (fixes #1251)
+
+0.9.14 / 2013-03-29
+===================
+
+  * manager: fix memory leak with SSL [jpallen]
+
+0.9.13 / 2012-12-13
+===================
+
+  * package: fixed `base64id` requirement
+
 0.9.12 / 2012-12-13
 ===================
 

lib/manager.js

@@ -616,6 +616,7 @@ Manager.prototype.handleUpgrade = function (req, socket, head) {
 
   req.head = head;
   this.handleClient(data, req);
+  req.head = null;
 };
 
 /**

lib/socket.io.js

@@ -15,7 +15,7 @@ var client = require('socket.io-client');
  * Version.
  */
 
-exports.version = '0.9.11';
+exports.version = '0.9.15';
 
 /**
  * Supported protocol version.

lib/transports/htmlfile.js

@@ -72,7 +72,8 @@ HTMLFile.prototype.handleRequest = function (req) {
  */
 
 HTMLFile.prototype.write = function (data) {
-  data = '<script>_(' + JSON.stringify(data) + ');</script>';
+  // escape all forward slashes. see GH-1251
+  data = '<script>_(' + JSON.stringify(data).replace(/\//g, '//') + ');</script>';
 
   if (this.response.write(data)) {
     this.drained = true;

package.json

@@ -1,6 +1,6 @@
 {
     "name": "socket.io"
-  , "version": "0.9.12"
+  , "version": "0.9.15"
   , "description": "Real-time apps made cross-browser & easy with a WebSocket-like API"
   , "homepage": "http://socket.io"
   , "keywords": ["websocket", "socket", "realtime", "socket.io", "comet", "ajax"]
@@ -16,8 +16,9 @@
       , "url": "https://github.com/LearnBoost/socket.io.git"
     }
   , "dependencies": {
-        "socket.io-client": "0.9.11"
+        "socket.io-client": "0.9.15"
       , "policyfile": "0.0.4"
+      , "base64id": "0.1.0"
     }
   , "devDependencies": {
         "expresso": "0.9.2"