@tldraw/sync-core 5.5.0-next.130e77150557 → 5.5.0-next.14c42da77533

package/src/lib/chunk.ts

@@ -8,6 +8,35 @@ const MAX_BYTES_PER_CHAR = 4
 // in the (admittedly impossible) worst case, the max size is 1/4 of a megabyte
 const MAX_SAFE_MESSAGE_SIZE = MAX_CLIENT_SENT_MESSAGE_SIZE_BYTES / MAX_BYTES_PER_CHAR
 
+// JsonChunkAssembler holds every chunk of a message until the last one arrives, and the sender
+// decides how many that is — the count is just a prefix on the first chunk. Nothing in the
+// protocol obliges a sender to ever send the last chunk, so without a ceiling a single connection
+// can make the receiver hold an arbitrarily large buffer for as long as the socket stays open.
+//
+// The cap counts UTF-16 code units, which is what a JS string costs in memory: 16M of them is the
+// 32MB of retained string data a room can afford to hold per session and stay inside a Durable
+// Object's 128MB instance limit with room for the document itself. It is far above anything
+// chunk() produces for a real document push. The character cap is the real bound; the chunk-count
+// cap only rejects an absurd declared count on arrival instead of waiting for the characters to
+// accumulate, and is loose enough not to constrain a sender that chunks more finely than the
+// default.
+export const MAX_ASSEMBLED_MESSAGE_CHARS = 16 * 1024 * 1024
+export const MAX_CHUNK_COUNT = 100_000
+
+/**
+ * Thrown when a message would exceed MAX_ASSEMBLED_MESSAGE_CHARS, on either side of the wire.
+ * Distinct from the other assembly errors because it is fatal: retrying sends the same
+ * oversized message, so the session is rejected rather than reset.
+ *
+ * @internal
+ */
+export class MessageTooLargeError extends Error {
+	constructor(chars: number) {
+		super(`Message too large: ${chars} characters, max ${MAX_ASSEMBLED_MESSAGE_CHARS}`)
+		this.name = 'MessageTooLargeError'
+	}
+}
+
 /**
  * Splits a string into smaller chunks suitable for transmission over WebSockets.
  * This function ensures messages don't exceed size limits imposed by platforms like Cloudflare Workers (1MB max).
@@ -100,6 +129,7 @@ export class JsonChunkAssembler {
 		| {
 				chunksReceived: string[]
 				totalChunks: number
+				charsReceived: number
 		  } = 'idle'
 
 	/**
@@ -110,7 +140,8 @@ export class JsonChunkAssembler {
 	 * @param msg - The message to process, either JSON or chunk format
 	 * @returns Result object with data/stringified on success, error object on failure, or null for incomplete chunks
 	 * 	- `\{ data: object, stringified: string \}` - Successfully parsed complete message
-	 * 	- `\{ error: Error \}` - Parse error or invalid chunk sequence
+	 * 	- `\{ error: Error \}` - Parse error, invalid chunk sequence, or a message exceeding
+	 * 	  MAX_ASSEMBLED_MESSAGE_CHARS / MAX_CHUNK_COUNT
 	 * 	- `null` - Chunk received but more chunks expected
 	 *
 	 * @example
@@ -144,17 +175,30 @@ export class JsonChunkAssembler {
 			const data = match[2]
 
 			if (this.state === 'idle') {
+				const totalChunks = numChunksRemaining + 1
+				if (totalChunks > MAX_CHUNK_COUNT) {
+					// Nothing has been buffered yet, so the state is already idle.
+					return { error: new Error(`Too many chunks: ${totalChunks}`) }
+				}
 				this.state = {
 					chunksReceived: [data],
-					totalChunks: numChunksRemaining + 1,
+					totalChunks,
+					charsReceived: data.length,
 				}
 			} else {
 				this.state.chunksReceived.push(data)
+				this.state.charsReceived += data.length
 				if (numChunksRemaining !== this.state.totalChunks - this.state.chunksReceived.length) {
 					this.state = 'idle'
 					return { error: new Error(`Chunks received in wrong order`) }
 				}
 			}
+			if (this.state.charsReceived > MAX_ASSEMBLED_MESSAGE_CHARS) {
+				// Drop what was buffered rather than keeping it until the socket closes.
+				const charsReceived = this.state.charsReceived
+				this.state = 'idle'
+				return { error: new MessageTooLargeError(charsReceived) }
+			}
 			if (this.state.chunksReceived.length === this.state.totalChunks) {
 				try {
 					const stringified = this.state.chunksReceived.join('')

package/src/test/TLSocketRoom.test.ts

@@ -21,6 +21,7 @@ import {
 	ZERO_INDEX_KEY,
 } from 'tldraw'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { MAX_ASSEMBLED_MESSAGE_CHARS } from '../lib/chunk'
 import { RecordOpType } from '../lib/diff'
 import { DEFAULT_INITIAL_SNAPSHOT, InMemorySyncStorage } from '../lib/InMemorySyncStorage'
 import { getTlsyncProtocolVersion } from '../lib/protocol'
@@ -392,6 +393,29 @@ describe('28. TLSocketRoom (SR)', () => {
 			expect(room.getSessions()[0].isConnected).toBe(false)
 		})
 
+		it('[SR5] rejects the session when an assembly exceeds the size cap', () => {
+			const log: TLSyncLog = { warn: vi.fn(), error: vi.fn() }
+			const room = new TLSocketRoom({ log })
+			const socket = createMockSocket()
+			connectSession(room, 'test-session', socket)
+
+			// A chunk stream that never sends its last chunk. Unlike the other assembly errors
+			// this one is fatal: a reconnecting client would re-send the same oversized message.
+			const body = 'x'.repeat(1024 * 1024)
+			const chunksNeeded = Math.ceil(MAX_ASSEMBLED_MESSAGE_CHARS / body.length) + 1
+			for (let i = 0; i < chunksNeeded; i++) {
+				room.handleSocketMessage('test-session', `${chunksNeeded - i}_${body}`)
+				if ((log.error as any).mock.calls.length) break
+			}
+
+			expect(log.error).toHaveBeenCalledWith('Error assembling message', expect.anything())
+			expect(socket.close).toHaveBeenCalledWith(
+				TLSyncErrorCloseEventCode,
+				TLSyncErrorCloseEventReason.MESSAGE_TOO_LARGE
+			)
+			expect(room.getSessions()).toHaveLength(0)
+		})
+
 		it('[SR5] rejects the session with UNKNOWN_ERROR when message handling throws', () => {
 			const log: TLSyncLog = { warn: vi.fn(), error: vi.fn() }
 			const room = new TLSocketRoom({ log })

package/src/test/TLSyncRoom.test.ts

@@ -1019,6 +1019,52 @@ describe('23. Connect handshake (HS)', () => {
 		expect(room.sessions.get('current-client-session')?.state).toBe(RoomSessionState.Connected)
 		expect(socket.__lastMessage?.type).toBe('connect')
 	})
+
+	it('[RC5][HS6] a wipeAll during a handshake closes connected sessions but hydrates the connecting one', async () => {
+		const { room, storage } = makeRoom()
+		const socketA = connectSession(room, 'a')
+		const removed = vi.fn()
+		room.events.on('session_removed', removed)
+
+		// 'b' has opened its socket but not yet sent its connect message
+		const socketB = makeSocket()
+		room.handleNewSession({ sessionId: 'b', socket: socketB, meta: undefined, isReadonly: false })
+
+		// the room hasn't seen this change yet because the storage notifies on a microtask
+		const newPage = makePage('wipe_page', 'Wipe Page')
+		storage.transaction((txn) => {
+			txn.set(newPage.id, newPage)
+		})
+		storage.tombstoneHistoryStartsAtClock.set(storage.getClock())
+
+		// the handshake's own transaction runs broadcastChanges first and hits the wipeAll
+		room.handleMessage('b', {
+			type: 'connect',
+			connectRequestId: 'connect-b',
+			lastServerClock: 0,
+			protocolVersion: getTlsyncProtocolVersion(),
+			schema: room.serializedSchema,
+		} satisfies TLConnectRequest)
+
+		expect(socketA.close).toHaveBeenCalled()
+		expect(room.sessions.has('a')).toBe(false)
+
+		expect(socketB.close).not.toHaveBeenCalled()
+		expect(room.sessions.get('b')?.state).toBe(RoomSessionState.Connected)
+		expect(socketB.__messages).toHaveLength(1)
+		const connectMessage = socketB.__lastMessage as Extract<
+			TLSocketServerSentEvent<any>,
+			{ type: 'connect' }
+		>
+		expect(connectMessage.type).toBe('connect')
+		expect(connectMessage.hydrationType).toBe('wipe_all')
+		expect(connectMessage.diff[newPage.id]).toEqual(['put', newPage])
+
+		await Promise.resolve()
+		await Promise.resolve()
+		expect(removed.mock.calls.map(([e]) => e.sessionId)).toEqual(['a'])
+		expect(room.sessions.has('b')).toBe(true)
+	})
 })
 
 describe('24. Push handling (RP)', () => {
@@ -2340,6 +2386,31 @@ describe('26. Session lifecycle (SES)', () => {
 		expect(room.sessions.size).toBe(0)
 	})
 
+	it('[SES4] a reason longer than 123 UTF-8 bytes is truncated on a code-point boundary with a dropped-bytes suffix', () => {
+		const { room } = makeRoom()
+
+		const exact = connectSession(room, 'exact')
+		room.rejectSession('exact', 'x'.repeat(123))
+		expect(exact.close).toHaveBeenCalledWith(TLSyncErrorCloseEventCode, 'x'.repeat(123))
+
+		// '... (+200 bytes)' reserves 16 bytes, leaving 107 for the reason
+		const ascii = connectSession(room, 'ascii')
+		room.rejectSession('ascii', 'x'.repeat(200))
+		expect(ascii.close).toHaveBeenCalledWith(
+			TLSyncErrorCloseEventCode,
+			'x'.repeat(107) + '... (+93 bytes)'
+		)
+
+		// 161 bytes in, 107 to fill: 1 + 26 × 4 = 105, and a 27th 4-byte character is dropped whole
+		const emoji = connectSession(room, 'emoji')
+		room.rejectSession('emoji', 'x' + '\u{1F600}'.repeat(40))
+		expect(emoji.close).toHaveBeenCalledWith(
+			TLSyncErrorCloseEventCode,
+			'x' + '\u{1F600}'.repeat(26) + '... (+56 bytes)'
+		)
+		expect(room.sessions.size).toBe(0)
+	})
+
 	it('[HS2][SES5] sets supportsStringAppend to false for protocol version 7', () => {
 		const { room } = makeRoom()
 		connectSession(room, 'v7-session', { protocolVersion: 7 })