websocket-driver 0.6.2 → 0.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f1bf44c48fb73c1472cc8c5752bc87cd38f545bf
-  data.tar.gz: 9a95a47349ec213020574596650c27d50db93fa7
+  metadata.gz: e35545d555e0f2a1d4846483ed021aed831be4aa
+  data.tar.gz: 4fbb5db8194130225cc4130862cec3126729fafe
 SHA512:
-  metadata.gz: ddf6c23ad1b0f2a9f9c5f4f67978efbec3916bb26754941008da6a488ea5b151ddd504664699cbf1bcee422aaea2b860955af9ccd5f257266be33e7f344be2fd
-  data.tar.gz: cf55f6a6e0c62790f8b40efa7af9fdb174e354b8a2d14c218a6421f3258c8c2237c38449eb100e53c650191da8df8df35039e6456acf3c783ba2eeccbe79e70a
+  metadata.gz: ddf14ddda68f212cd4453fd0b5e97f8e3b1e0c9741d2bfbb1e6b7b208846cd636b7d73045af9975de3451d7a1c8995e455429e10ea00b3a03026b64d90c44d9f
+  data.tar.gz: dd0fd4513efe1a75012d942293b751de86e1c45836b3551b54e52044df95c0f005ae50ad2a8a761e79f5e3f1f4ec872d97116c7750ffbb3964f4ca327509abeb

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+### 0.6.3 / 2015-11-06
+
+* Reject draft-76 handshakes if their Sec-WebSocket-Key headers are invalid
+* Throw a more helpful error if a client is created with an invalid URL
+
 ### 0.6.2 / 2015-07-18
 
 * When the peer sends a close frame with no error code, emit 1000

data/ext/websocket-driver/websocket_mask.c

@@ -20,7 +20,7 @@ method_websocket_mask(VALUE self,
                       VALUE mask)
 {
   char *payload_s, *mask_s, *unmasked_s;
-  int i, n;
+  long i, n;
   VALUE unmasked;
 
   if (mask == Qnil || RSTRING_LEN(mask) != 4) {

data/lib/websocket/driver.rb

@@ -46,6 +46,7 @@ module WebSocket
     CloseEvent   = Struct.new(:code, :reason)
 
     ProtocolError      = Class.new(StandardError)
+    URIError           = Class.new(ArgumentError)
     ConfigurationError = Class.new(ArgumentError)
 
     autoload :Client,       root + '/client'

data/lib/websocket/driver/client.rb

@@ -2,6 +2,8 @@ module WebSocket
   class Driver
 
     class Client < Hybi
+      VALID_SCHEMES = %w[ws wss]
+
       def self.generate_key
         Base64.strict_encode64(SecureRandom.random_bytes(16))
       end
@@ -16,7 +18,11 @@ module WebSocket
         @accept      = Hybi.generate_accept(@key)
         @http        = HTTP::Response.new
 
-        uri       = URI.parse(@socket.url)
+        uri = URI.parse(@socket.url)
+        unless VALID_SCHEMES.include?(uri.scheme)
+          raise URIError, "#{socket.url} is not a valid WebSocket URL"
+        end
+
         host      = uri.host + (uri.port ? ":#{uri.port}" : '')
         path      = (uri.path == '') ? '/' : uri.path
         @pathname = path + (uri.query ? '?' + uri.query : '')

data/lib/websocket/driver/draft76.rb

@@ -38,6 +38,24 @@ module WebSocket
     private
 
       def handshake_response
+        env     = @socket.env
+
+        key1    = env['HTTP_SEC_WEBSOCKET_KEY1']
+        number1 = number_from_key(key1)
+        spaces1 = spaces_in_key(key1)
+
+        key2    = env['HTTP_SEC_WEBSOCKET_KEY2']
+        number2 = number_from_key(key2)
+        spaces2 = spaces_in_key(key2)
+
+        if number1 % spaces1 != 0 or number2 % spaces2 != 0
+          emit(:error, ProtocolError.new('Client sent invalid Sec-WebSocket-Key headers'))
+          close
+          return nil
+        end
+
+        @key_values = [number1 / spaces1, number2 / spaces2]
+
         start   = 'HTTP/1.1 101 WebSocket Protocol Handshake'
         headers = [start, @headers.to_s, '']
         headers.join("\r\n")
@@ -46,14 +64,8 @@ module WebSocket
       def handshake_signature
         return nil unless @body.bytesize >= BODY_SIZE
 
-        head   = @body[0...BODY_SIZE]
-        env    = @socket.env
-        key1   = env['HTTP_SEC_WEBSOCKET_KEY1']
-        value1 = number_from_key(key1) / spaces_in_key(key1)
-        key2   = env['HTTP_SEC_WEBSOCKET_KEY2']
-        value2 = number_from_key(key2) / spaces_in_key(key2)
-
-        Digest::MD5.digest([value1, value2, head].pack('N2A*'))
+        head = @body[0...BODY_SIZE]
+        Digest::MD5.digest((@key_values + [head]).pack('N2A*'))
       end
 
       def send_handshake_body

data/lib/websocket/driver/server.rb

@@ -7,6 +7,7 @@ module WebSocket
       def initialize(socket, options = {})
         super
         @http = HTTP::Request.new
+        @delegate = nil
       end
 
       def env

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: websocket-driver
 version: !ruby/object:Gem::Version
-  version: 0.6.2
+  version: 0.6.3
 platform: ruby
 authors:
 - James Coglan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-07-18 00:00:00.000000000 Z
+date: 2015-11-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: websocket-extensions
@@ -136,7 +136,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.4.5.1
 signing_key: 
 specification_version: 4
 summary: WebSocket protocol handler with pluggable I/O