@nestjs/platform-ws 12.0.1 → 12.0.3

package/adapters/ws-adapter.d.ts

@@ -19,6 +19,7 @@ export declare class WsAdapter extends AbstractWsAdapter {
     protected readonly logger: Logger;
     protected readonly httpServersRegistry: Map<number, any>;
     protected readonly wsServersRegistry: Map<number, WsServerRegistryEntry>;
+    private readonly upgradeListenersRegistry;
     protected messageParser: WsMessageParser;
     constructor(appOrHttpServer?: INestApplicationContext | object, options?: WsAdapterOptions);
     create(port: number, options?: Record<string, any> & {

package/adapters/ws-adapter.js

@@ -3,7 +3,7 @@ import { AbstractWsAdapter } from '@nestjs/websockets';
 import * as http from 'http';
 import { createRequire } from 'module';
 import { EMPTY, fromEvent } from 'rxjs';
-import { filter, first, mergeMap, share, takeUntil } from 'rxjs/operators';
+import { catchError, filter, first, mergeMap, share, takeUntil, } from 'rxjs/operators';
 import { loadPackageSync, isNil, normalizePath } from '@nestjs/common/internal';
 import { CLOSE_EVENT, CONNECTION_EVENT, ERROR_EVENT, } from '@nestjs/websockets/internal';
 let wsPackage = {};
@@ -15,6 +15,11 @@ var READY_STATE;
     READY_STATE[READY_STATE["CLOSED_STATE"] = 3] = "CLOSED_STATE";
 })(READY_STATE || (READY_STATE = {}));
 const UNDERLYING_HTTP_SERVER_PORT = 0;
+// Kept out of the class so that an adapter can be compared against it to tell
+// whether the parser in use is still the built-in one.
+const defaultMessageParser = (data) => {
+    return JSON.parse(data.toString());
+};
 /**
  * @publicApi
  */
@@ -22,9 +27,8 @@ export class WsAdapter extends AbstractWsAdapter {
     logger = new Logger(WsAdapter.name);
     httpServersRegistry = new Map();
     wsServersRegistry = new Map();
-    messageParser = (data) => {
-        return JSON.parse(data.toString());
-    };
+    upgradeListenersRegistry = new Map();
+    messageParser = defaultMessageParser;
     constructor(appOrHttpServer, options) {
         super(appOrHttpServer);
         wsPackage = loadPackageSync('ws', 'WsAdapter', () => createRequire(import.meta.url)('ws'));
@@ -80,7 +84,14 @@ export class WsAdapter extends AbstractWsAdapter {
         const handlersMap = new Map();
         handlers.forEach(handler => handlersMap.set(handler.message, handler));
         const close$ = fromEvent(client, CLOSE_EVENT).pipe(share(), first());
-        const source$ = fromEvent(client, 'message').pipe(mergeMap(data => this.bindMessageHandler(data, handlersMap, transform).pipe(filter(result => !isNil(result)))), takeUntil(close$));
+        const source$ = fromEvent(client, 'message').pipe(mergeMap(data => this.bindMessageHandler(data, handlersMap, transform).pipe(filter(result => !isNil(result)), 
+        // a handler that rejects through an error filter that rethrows
+        // would error the client's stream and silence every later message;
+        // that rethrow is an app bug, so it gets logged, not dropped silently
+        catchError(err => {
+            this.logger.error(err);
+            return EMPTY;
+        }))), takeUntil(close$));
         const onMessage = (response) => {
             if (client.readyState !== READY_STATE.OPEN_STATE) {
                 return;
@@ -90,16 +101,37 @@ export class WsAdapter extends AbstractWsAdapter {
         source$.subscribe(onMessage);
     }
     bindMessageHandler(buffer, handlersMap, transform) {
+        let message;
         try {
-            const message = this.messageParser(buffer.data);
-            if (!message) {
-                return EMPTY;
+            message = this.messageParser(buffer.data);
+        }
+        catch (err) {
+            // A custom parser that throws is an application bug, and swallowing it
+            // leaves no trace of it anywhere. The default parser, on the other hand,
+            // throws on client-controlled input, so reporting that one would turn a
+            // public socket into a log flood target. A custom parser that wants a
+            // frame dropped silently can return nothing, which is handled below.
+            if (this.messageParser !== defaultMessageParser) {
+                this.logger.error(err);
             }
-            const messageHandler = handlersMap.get(message.event);
-            const { callback } = messageHandler;
-            return transform(callback(message.data, message.event));
+            return EMPTY;
+        }
+        if (!message) {
+            return EMPTY;
+        }
+        const messageHandler = handlersMap.get(message.event);
+        if (!messageHandler) {
+            // An unrecognised event is an expected condition on a public socket,
+            // not an error. It used to reach the catch below as a TypeError.
+            return EMPTY;
+        }
+        try {
+            return transform(messageHandler.callback(message.data, message.event));
         }
         catch {
+            // Kept deliberately: a synchronous throw here would otherwise propagate
+            // through the mergeMap in bindMessageHandlers and tear down the client's
+            // source stream, silencing every subsequent message from that client.
             return EMPTY;
         }
     }
@@ -128,9 +160,14 @@ export class WsAdapter extends AbstractWsAdapter {
         const closeEventSignals = Array.from(this.httpServersRegistry)
             .filter(([port]) => port !== UNDERLYING_HTTP_SERVER_PORT)
             .map(([_, server]) => new Promise(resolve => server.close(resolve)));
+        // A server passed in by the caller outlives this adapter, so the listener
+        // added to it has to be taken off explicitly. Servers created here are
+        // closed above and take their listeners with them.
+        this.upgradeListenersRegistry.forEach((listener, port) => this.httpServersRegistry.get(port)?.off('upgrade', listener));
         await Promise.all(closeEventSignals);
         this.httpServersRegistry.clear();
         this.wsServersRegistry.clear();
+        this.upgradeListenersRegistry.clear();
     }
     setMessageParser(parser) {
         this.messageParser = parser;
@@ -140,7 +177,7 @@ export class WsAdapter extends AbstractWsAdapter {
             return;
         }
         this.httpServersRegistry.set(port, httpServer);
-        httpServer.on('upgrade', (request, socket, head) => {
+        const upgradeListener = (request, socket, head) => {
             try {
                 const baseUrl = 'ws://' + request.headers.host + '/';
                 const pathname = new URL(request.url, baseUrl).pathname;
@@ -162,7 +199,9 @@ export class WsAdapter extends AbstractWsAdapter {
             catch (err) {
                 socket.end(`HTTP/1.1 400\r\n${err.message}`);
             }
-        });
+        };
+        httpServer.on('upgrade', upgradeListener);
+        this.upgradeListenersRegistry.set(port, upgradeListener);
         return httpServer;
     }
     addWsServerToRegistry(wsServer, port, path) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/platform-ws",
-  "version": "12.0.1",
+  "version": "12.0.3",
   "description": "Nest - modern, fast, powerful node.js web framework (@platform-ws)",
   "author": "Kamil Mysliwiec",
   "license": "MIT",
@@ -33,5 +33,5 @@
     "@nestjs/websockets": "^12.0.0",
     "rxjs": "^7.1.0"
   },
-  "gitHead": "4c751c503bc753095f4b4f052e106f95218cc33f"
+  "gitHead": "14151790e1abe870abc3bbf00f88786fc3ebe509"
 }