@arcblock/ws 1.30.10 → 1.30.11

package/esm/server/index.d.mts

@@ -40,6 +40,19 @@ interface WsServerOptions {
   skipLogOnHookError?: boolean;
   broadcastEventName?: string;
   heartbeatTimeout?: number;
+  /**
+   * Maximum size of a single inbound WebSocket frame in bytes. The `ws`
+   * library rejects oversized frames with close code 1009. Defaults to 64 KiB
+   * which is far above any legitimate Phoenix-protocol client message.
+   */
+  maxPayload?: number;
+  /**
+   * Maximum distinct `phx_join` topics a single socket can hold. Each join
+   * inserts a Set into `this.topics`, so an unbounded value lets a hostile
+   * client force unbounded server-side memory growth via random topic strings.
+   * Defaults to 64. Set to 0 to disable the cap.
+   */
+  maxTopicsPerSocket?: number;
 }
 interface BroadcastOptions {
   enableLog?: boolean;
@@ -81,6 +94,7 @@ declare class WsServer extends EventEmitter {
   logger: Logger;
   skipLogOnHookError: boolean;
   heartbeatTimeout: number;
+  maxTopicsPerSocket: number;
   wss: WebSocketServer;
   topics: Record<string, Set<WsSocket>>;
   broadcastEventName: string;

package/esm/server/index.mjs

@@ -41,6 +41,8 @@ const refreshHeartbeat = (socket) => {
 	socket.heartbeatAt = Date.now();
 };
 const HEARTBEAT_TIMEOUT = 300 * 1e3;
+const MAX_PAYLOAD = 64 * 1024;
+const MAX_TOPICS_PER_SOCKET = 64;
 /**
 * Create a websocket server
 *
@@ -63,9 +65,11 @@ var WsServer = class extends EventEmitter {
 		this.logger = opts.logger || logger_default("server", opts.silent);
 		this.skipLogOnHookError = opts.skipLogOnHookError || false;
 		this.heartbeatTimeout = opts.heartbeatTimeout || HEARTBEAT_TIMEOUT;
+		this.maxTopicsPerSocket = opts.maxTopicsPerSocket ?? MAX_TOPICS_PER_SOCKET;
 		this.wss = new WebSocketServer({
 			noServer: true,
-			clientTracking: false
+			clientTracking: false,
+			maxPayload: opts.maxPayload ?? MAX_PAYLOAD
 		});
 		this.wss.on("connection", this.onWssConnection.bind(this));
 		this.wss.on("close", this.onWssClose.bind(this));
@@ -295,6 +299,18 @@ var WsServer = class extends EventEmitter {
 				return;
 			}
 			if (event === "phx_join") {
+				if (this.maxTopicsPerSocket > 0 && !(topic in wsSocket.channel) && Object.keys(wsSocket.channel).length >= this.maxTopicsPerSocket) {
+					reply({
+						socket: wsSocket,
+						topic,
+						event: `chan_reply_${ref}`,
+						data: { message: `topic limit reached (max ${this.maxTopicsPerSocket} per socket)` },
+						status: "error",
+						ref,
+						joinRef
+					});
+					return;
+				}
 				try {
 					const authInfo = await this.hooks.authenticateJoinChannel({
 						socket: wsSocket,

package/lib/server/index.cjs

@@ -46,6 +46,8 @@ const refreshHeartbeat = (socket) => {
 	socket.heartbeatAt = Date.now();
 };
 const HEARTBEAT_TIMEOUT = 300 * 1e3;
+const MAX_PAYLOAD = 64 * 1024;
+const MAX_TOPICS_PER_SOCKET = 64;
 /**
 * Create a websocket server
 *
@@ -68,9 +70,11 @@ var WsServer = class extends node_events.default {
 		this.logger = opts.logger || require_logger.default("server", opts.silent);
 		this.skipLogOnHookError = opts.skipLogOnHookError || false;
 		this.heartbeatTimeout = opts.heartbeatTimeout || HEARTBEAT_TIMEOUT;
+		this.maxTopicsPerSocket = opts.maxTopicsPerSocket ?? MAX_TOPICS_PER_SOCKET;
 		this.wss = new ws.WebSocketServer({
 			noServer: true,
-			clientTracking: false
+			clientTracking: false,
+			maxPayload: opts.maxPayload ?? MAX_PAYLOAD
 		});
 		this.wss.on("connection", this.onWssConnection.bind(this));
 		this.wss.on("close", this.onWssClose.bind(this));
@@ -300,6 +304,18 @@ var WsServer = class extends node_events.default {
 				return;
 			}
 			if (event === "phx_join") {
+				if (this.maxTopicsPerSocket > 0 && !(topic in wsSocket.channel) && Object.keys(wsSocket.channel).length >= this.maxTopicsPerSocket) {
+					reply({
+						socket: wsSocket,
+						topic,
+						event: `chan_reply_${ref}`,
+						data: { message: `topic limit reached (max ${this.maxTopicsPerSocket} per socket)` },
+						status: "error",
+						ref,
+						joinRef
+					});
+					return;
+				}
 				try {
 					const authInfo = await this.hooks.authenticateJoinChannel({
 						socket: wsSocket,

package/lib/server/index.d.cts

@@ -40,6 +40,19 @@ interface WsServerOptions {
   skipLogOnHookError?: boolean;
   broadcastEventName?: string;
   heartbeatTimeout?: number;
+  /**
+   * Maximum size of a single inbound WebSocket frame in bytes. The `ws`
+   * library rejects oversized frames with close code 1009. Defaults to 64 KiB
+   * which is far above any legitimate Phoenix-protocol client message.
+   */
+  maxPayload?: number;
+  /**
+   * Maximum distinct `phx_join` topics a single socket can hold. Each join
+   * inserts a Set into `this.topics`, so an unbounded value lets a hostile
+   * client force unbounded server-side memory growth via random topic strings.
+   * Defaults to 64. Set to 0 to disable the cap.
+   */
+  maxTopicsPerSocket?: number;
 }
 interface BroadcastOptions {
   enableLog?: boolean;
@@ -81,6 +94,7 @@ declare class WsServer extends EventEmitter {
   logger: Logger;
   skipLogOnHookError: boolean;
   heartbeatTimeout: number;
+  maxTopicsPerSocket: number;
   wss: WebSocketServer;
   topics: Record<string, Set<WsSocket>>;
   broadcastEventName: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arcblock/ws",
-  "version": "1.30.10",
+  "version": "1.30.11",
   "description": "OCAP Chain websocket server and client",
   "keywords": [
     "websocket"
@@ -75,7 +75,7 @@
     "url": "https://github.com/ArcBlock/blockchain/issues"
   },
   "dependencies": {
-    "@arcblock/event-hub": "1.30.10",
+    "@arcblock/event-hub": "1.30.11",
     "debug": "^4.4.3",
     "eventemitter3": "^4.0.7",
     "lodash": "^4.17.23",