@automerge/automerge-repo-network-websocket 2.0.0-alpha.12 → 2.0.0-alpha.13

package/dist/NodeWSServerAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NodeWSServerAdapter.d.ts","sourceRoot":"","sources":["../src/NodeWSServerAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAKpD,OAAO,EAEL,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,MAAM,EACZ,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAEL,iBAAiB,EAElB,MAAM,eAAe,CAAA;AAOtB,qBAAa,mBAAoB,SAAQ,cAAc;;IAyBnD,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,iBAAiB;IAzB3B,OAAO,EAAE;QAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAK;IAQ7C,OAAO;IAIP,SAAS;gBAYC,MAAM,EAAE,eAAe,EACvB,iBAAiB,SAAO;IAKlC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,YAAY;IAyCnD,UAAU;IAQV,IAAI,CAAC,OAAO,EAAE,iBAAiB;IAqB/B,cAAc,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS;CAoE3D"}
+{"version":3,"file":"NodeWSServerAdapter.d.ts","sourceRoot":"","sources":["../src/NodeWSServerAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,eAAe,CAAA;AACrC,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAKpD,OAAO,EAEL,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,MAAM,EACZ,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAEL,iBAAiB,EAElB,MAAM,eAAe,CAAA;AAOtB,qBAAa,mBAAoB,SAAQ,cAAc;;IAyBnD,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,iBAAiB;IAzB3B,OAAO,EAAE;QAAE,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAK;IAQ7C,OAAO;IAIP,SAAS;gBAYC,MAAM,EAAE,eAAe,EACvB,iBAAiB,SAAO;IAKlC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,YAAY;IAyCnD,UAAU;IAQV,IAAI,CAAC,OAAO,EAAE,iBAAiB;IAqB/B,cAAc,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS;CA2E3D"}

package/dist/NodeWSServerAdapter.js

@@ -89,7 +89,15 @@ export class NodeWSServerAdapter extends NetworkAdapter {
         socket.send(arrayBuf);
     }
     receiveMessage(messageBytes, socket) {
-        const message = decode(messageBytes);
+        let message;
+        try {
+            message = decode(messageBytes);
+        }
+        catch (e) {
+            log("invalid message received, closing connection");
+            socket.close();
+            return;
+        }
         const { type, senderId } = message;
         const myPeerId = this.peerId;
         assert(myPeerId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automerge/automerge-repo-network-websocket",
-  "version": "2.0.0-alpha.12",
+  "version": "2.0.0-alpha.13",
   "description": "isomorphic node/browser Websocket network adapter for Automerge Repo",
   "repository": "https://github.com/automerge/automerge-repo/tree/master/packages/automerge-repo-network-websocket",
   "author": "Peter van Hardenberg <pvh@pvh.ca>",
@@ -13,7 +13,7 @@
     "test": "vitest"
   },
   "dependencies": {
-    "@automerge/automerge-repo": "2.0.0-alpha.12",
+    "@automerge/automerge-repo": "2.0.0-alpha.13",
     "cbor-x": "^1.3.0",
     "debug": "^4.3.4",
     "eventemitter3": "^5.0.1",
@@ -31,5 +31,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "8b016e42d2518ebb11eb148f52b9fb9a0b4467ff"
+  "gitHead": "f4504b4e6441d938df54f77adf0d629f26ff9a7c"
 }

package/src/NodeWSServerAdapter.ts

@@ -123,7 +123,14 @@ export class NodeWSServerAdapter extends NetworkAdapter {
   }
 
   receiveMessage(messageBytes: Uint8Array, socket: WebSocket) {
-    const message: FromClientMessage = decode(messageBytes)
+    let message: FromClientMessage
+    try {
+      message = decode(messageBytes)
+    } catch (e) {
+      log("invalid message received, closing connection")
+      socket.close()
+      return
+    }
 
     const { type, senderId } = message
 

package/test/Websocket.test.ts

@@ -338,6 +338,43 @@ describe("Websocket adapters", () => {
       await eventPromise(serverAdapter, "peer-disconnected")
     })
 
+    it("should disconnect from a client that sends an invalid CBOR message", async () => {
+      // Set up a server and wait for it to be ready
+      const port = await getPort()
+      const serverUrl = `ws://localhost:${port}`
+      const server = http.createServer()
+      const serverSocket = new WebSocket.Server({ server })
+      await new Promise<void>(resolve => server.listen(port, resolve))
+
+      // Create a repo listening on the socket
+      const serverAdapter = new NodeWSServerAdapter(serverSocket)
+      const serverRepo = new Repo({
+        network: [serverAdapter],
+        peerId: serverPeerId,
+      })
+
+      // Create a new socket connected to the repo
+      const browserSocket = new WebSocket(serverUrl)
+      await new Promise(resolve => browserSocket.on("open", resolve))
+      const disconnected = new Promise(resolve =>
+        browserSocket.on("close", resolve)
+      )
+
+      // Send an invalid CBOR message, in this case we use a definite length
+      // array with too many elements. This test should actually work for any
+      // invalid message but this reproduces a specific issue we were seeing on
+      // the sycn server
+      //
+      // 0x9 (1001) is major type 4, for an array
+      // 0xB (1011) indicates that the length will be encoded in the next 8 bytes
+      // 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00 is 2**32, which is longer than allowed
+      const invalidLargeArray = new Uint8Array([
+        0x9b, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00,
+      ])
+      browserSocket.send(invalidLargeArray)
+      await disconnected
+    })
+
     it("should send the negotiated protocol version in its hello message", async () => {
       const response = await serverResponse({
         type: "join",