@tldraw/sync-core 5.5.0 → 5.6.0-canary.5bfc37740468

package/src/lib/diff.ts

@@ -1,5 +1,5 @@
 import { RecordsDiff, UnknownRecord } from '@tldraw/store'
-import { isEqual, objectMapEntries, objectMapValues } from '@tldraw/utils'
+import { hasOwnProperty, isEqual, objectMapEntries, objectMapValues } from '@tldraw/utils'
 
 /**
  * Constants representing the types of operations that can be applied to records in network diffs.
@@ -200,15 +200,21 @@ function diffObject(
 		return null
 	}
 	let result: ObjectDiff | null = null
+	// Own-property checks throughout: `in` would see Object.prototype members, so a user key named
+	// e.g. 'constructor' would never diff as an add or delete. And a key whose value is `undefined`
+	// is treated as absent: `undefined` doesn't survive JSON, so `['put', undefined]` would arrive
+	// as `['put', null]` and fail validators that accept only the missing key.
 	for (const key of Object.keys(prev)) {
-		// if key is not in next then it was deleted
-		if (!(key in next)) {
+		// `result['__proto__'] = op` would set the diff's prototype, and applyObjectDiff drops the key (AD8)
+		if (key === '__proto__') continue
+		const prevValue = (prev as any)[key]
+		if (prevValue === undefined) continue
+		const nextValue = hasOwnProperty(next, key) ? (next as any)[key] : undefined
+		if (nextValue === undefined) {
 			if (!result) result = {}
 			result[key] = [ValueOpType.Delete]
 			continue
 		}
-		const prevValue = (prev as any)[key]
-		const nextValue = (next as any)[key]
 		if (
 			nestedKeys?.has(key) ||
 			(Array.isArray(prevValue) && Array.isArray(nextValue)) ||
@@ -226,10 +232,13 @@ function diffObject(
 		}
 	}
 	for (const key of Object.keys(next)) {
+		if (key === '__proto__') continue
+		const nextValue = (next as any)[key]
+		if (nextValue === undefined) continue
 		// if key is in next but not in prev then it was added
-		if (!(key in prev)) {
+		if (!hasOwnProperty(prev, key) || (prev as any)[key] === undefined) {
 			if (!result) result = {}
-			result[key] = [ValueOpType.Put, (next as any)[key]]
+			result[key] = [ValueOpType.Put, nextValue]
 		}
 	}
 	return result
@@ -245,7 +254,15 @@ function diffValue(valueA: unknown, valueB: unknown, legacyAppendMode: boolean):
 			return [ValueOpType.Append, appendedText, valueA.length]
 		}
 		return [ValueOpType.Put, valueB]
-	} else if (!valueA || !valueB || typeof valueA !== 'object' || typeof valueB !== 'object') {
+	} else if (
+		!valueA ||
+		!valueB ||
+		typeof valueA !== 'object' ||
+		typeof valueB !== 'object' ||
+		// an array on one side and a plain object on the other can't be expressed as a patch:
+		// index deletes and named puts don't apply cleanly to either shape
+		Array.isArray(valueA) !== Array.isArray(valueB)
+	) {
 		return isEqual(valueA, valueB) ? null : [ValueOpType.Put, valueB]
 	} else {
 		const diff = diffObject(valueA, valueB, undefined, legacyAppendMode)
@@ -348,6 +365,10 @@ export function applyObjectDiff<T extends object>(object: T, objectDiff: ObjectD
 		}
 	}
 	for (const [key, op] of Object.entries(objectDiff)) {
+		// Diffs come off the wire from untrusted peers. `newObject['__proto__'] = v` would set the
+		// record's prototype (JSON.parse creates '__proto__' as an own key), so a client could give
+		// server-held records attacker-controlled inherited fields; skip such keys outright.
+		if (key === '__proto__') continue
 		switch (op[0]) {
 			case ValueOpType.Put: {
 				const value = op[1]
@@ -383,7 +404,7 @@ export function applyObjectDiff<T extends object>(object: T, objectDiff: ObjectD
 				break
 			}
 			case ValueOpType.Delete: {
-				if (key in object) {
+				if (hasOwnProperty(object, key)) {
 					if (!newObject) {
 						if (isArray) {
 							console.error("Can't delete array item yet (this should never happen)")

package/src/test/TLSyncRoom.test.ts

@@ -2482,6 +2482,130 @@ describe('26. Session lifecycle (SES)', () => {
 		expect(socket.__lastMessage).toEqual({ type: 'pong' })
 	})
 
+	it('[SES5] no session receives string-append ops while a client without append support is connected', () => {
+		vi.useFakeTimers()
+		const { room } = makeRoom()
+		const v8 = connectSession(room, 'v8', { protocolVersion: getTlsyncProtocolVersion() })
+		const v7 = connectSession(room, 'v7', { protocolVersion: 7 })
+		expect(room.getCanEmitStringAppend()).toBe(false)
+
+		const hasAppend = (msg: any) => JSON.stringify(msg).includes('"append"')
+
+		// a full put over an existing record whose only change is a string append
+		room.handleMessage('v8', {
+			type: 'push',
+			clientClock: 1,
+			diff: { [pageRecord.id]: ['put', { ...pageRecord, name: pageRecord.name + ' more' }] },
+		} as TLPushRequest<TLRecord>)
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL + 1)
+		expect(sentDataMessages(v7)).toEqual([
+			{
+				type: 'patch',
+				diff: { [pageRecord.id]: ['patch', { name: ['put', pageRecord.name + ' more'] }] },
+				serverClock: 1,
+			},
+		])
+		expect(sentDataMessages(v8).some(hasAppend)).toBe(false)
+		clearSocket(v7)
+		clearSocket(v8)
+
+		// a patch whose recomputed broadcast would otherwise be an append
+		room.handleMessage('v8', {
+			type: 'push',
+			clientClock: 2,
+			diff: { [pageRecord.id]: ['patch', { name: ['put', pageRecord.name + ' more and more'] }] },
+		} as TLPushRequest<TLRecord>)
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL + 1)
+		expect(sentDataMessages(v7)).toEqual([
+			{
+				type: 'patch',
+				diff: {
+					[pageRecord.id]: ['patch', { name: ['put', pageRecord.name + ' more and more'] }],
+				},
+				serverClock: 2,
+			},
+		])
+		expect(sentDataMessages(v8)).toEqual([
+			{ type: 'push_result', clientClock: 2, serverClock: 2, action: 'commit' },
+		])
+	})
+
+	it('[SES6] handleResumedSession rejects a session whose schema the server can no longer reconcile', () => {
+		const { room } = makeRoom()
+		const socket = makeSocket()
+		const newerSchema: SerializedSchemaV2 = {
+			schemaVersion: 2,
+			sequences: {
+				...(room.serializedSchema as SerializedSchemaV2).sequences,
+				'com.tldraw.store': 999,
+			},
+		}
+
+		room.handleResumedSession({
+			sessionId: 'resumed',
+			socket,
+			meta: undefined,
+			isReadonly: false,
+			serializedSchema: newerSchema,
+			presenceId: null,
+			presenceRecord: null,
+			requiresLegacyRejection: false,
+			supportsStringAppend: true,
+		})
+
+		expect(room.sessions.has('resumed')).toBe(false)
+		expect(socket.close).toHaveBeenCalledWith(
+			TLSyncErrorCloseEventCode,
+			TLSyncErrorCloseEventReason.SERVER_TOO_OLD
+		)
+	})
+
+	it('[SES6] rejecting a resumed session removes its restored presence for other sessions', () => {
+		vi.useFakeTimers()
+		const { room } = makeRoom()
+		const makePresence = (name: string) =>
+			InstancePresenceRecordType.create({
+				id: InstancePresenceRecordType.createId(name),
+				currentPageId: pageRecord.id,
+				userId: createUserId(name),
+				userName: name,
+			})
+		const resume = (sessionId: string, serializedSchema: SerializedSchema) => {
+			const socket = makeSocket()
+			const presenceRecord = makePresence(sessionId)
+			room.handleResumedSession({
+				sessionId,
+				socket,
+				meta: undefined,
+				isReadonly: false,
+				serializedSchema,
+				presenceId: presenceRecord.id,
+				presenceRecord,
+				requiresLegacyRejection: false,
+				supportsStringAppend: true,
+			})
+			return { socket, presenceId: presenceRecord.id }
+		}
+
+		const other = resume('other', room.serializedSchema)
+		const rejected = resume('rejected', {
+			schemaVersion: 2,
+			sequences: {
+				...(room.serializedSchema as SerializedSchemaV2).sequences,
+				'com.tldraw.store': 999,
+			},
+		})
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL * 2)
+
+		expect(room.sessions.has('rejected')).toBe(false)
+		expect(room.presenceStore.get(rejected.presenceId)).toBeUndefined()
+		// other clients still hold this presence from before the socket slept
+		expect(sentDataMessages(other.socket).at(-1)).toMatchObject({
+			type: 'patch',
+			diff: { [rejected.presenceId]: [RecordOpType.Remove] },
+		})
+	})
+
 	it('[SES7] a message from an unknown session id logs a warning and is ignored', () => {
 		const warn = vi.fn()
 		const { room } = makeRoom({ log: { warn } })

package/src/test/upgradeDowngrade.test.ts

@@ -413,6 +413,27 @@ it('[HS3] out-of-date clients will receive incompatibility errors', () => {
 	expect(socket.close).toHaveBeenCalledWith(4099, TLSyncErrorCloseEventReason.CLIENT_TOO_OLD)
 })
 
+it.each([
+	['a v2 schema without sequences', { schemaVersion: 2 }],
+	['a v2 schema with null sequences', { schemaVersion: 2, sequences: null }],
+	['a null schema', null],
+])('[HS3] clients sending %s are rejected as too old', (_, schema) => {
+	const server = new TestServer(schemaV3)
+	const id = 'test_malformed_schema'
+	const socket = mockSocket()
+
+	server.room.handleNewSession({ sessionId: id, socket, meta: undefined, isReadonly: false })
+	server.room.handleMessage(id, {
+		type: 'connect',
+		connectRequestId: 'test',
+		lastServerClock: 0,
+		protocolVersion: getTlsyncProtocolVersion(),
+		schema: schema as any,
+	})
+
+	expect(socket.close).toHaveBeenCalledWith(4099, TLSyncErrorCloseEventReason.CLIENT_TOO_OLD)
+})
+
 it('[HS2] clients using an out-of-date protocol will receive compatibility errors', () => {
 	const actualVersion = getTlsyncProtocolVersion()
 	mockGetTlsyncProtocolVersion.mockReturnValue(actualVersion + 1)