@tldraw/sync-core 5.5.2 → 5.6.0-canary.0091c91994d6

package/src/lib/TLSyncStorage.ts

@@ -146,13 +146,18 @@ export interface TLSyncForwardDiff<R extends UnknownRecord> {
 }
 
 /**
+ * @param legacyAppendMode - When true, string appends are emitted as puts (see `diffRecord`); the
+ * room sets this whenever a connected client predates string-append support.
  * @internal
  */
-export function toNetworkDiff<R extends UnknownRecord>(diff: TLSyncForwardDiff<R>): NetworkDiff<R> {
+export function toNetworkDiff<R extends UnknownRecord>(
+	diff: TLSyncForwardDiff<R>,
+	legacyAppendMode = false
+): NetworkDiff<R> {
 	const networkDiff: NetworkDiff<R> = {}
 	for (const [id, put] of objectMapEntriesIterable(diff.puts)) {
 		if (Array.isArray(put)) {
-			const patch = diffRecord(put[0], put[1])
+			const patch = diffRecord(put[0], put[1], legacyAppendMode)
 			if (patch) {
 				networkDiff[id] = [RecordOpType.Patch, patch]
 			}

package/src/lib/diff.test.ts

@@ -39,6 +39,52 @@ describe('computing diffs (D)', () => {
 			expect(patch).toEqual({ c: [ValueOpType.Put, 3] })
 			expect(applyObjectDiff(a, patch!)).toEqual(b)
 		})
+
+		it('[D2] treats a key whose value is undefined as absent', () => {
+			// undefined does not survive JSON, so `['put', undefined]` would arrive as
+			// `['put', null]` and fail validators that only accept the key being missing
+			const present = { a: 1, props: { foo: 'x' } }
+			const explicitlyUndefined = { a: 1, props: { foo: undefined } }
+			const absent = { a: 1, props: {} }
+
+			expect(diffRecord(present, explicitlyUndefined)).toEqual({
+				props: [ValueOpType.Patch, { foo: [ValueOpType.Delete] }],
+			})
+			expect(diffRecord(explicitlyUndefined, present)).toEqual({
+				props: [ValueOpType.Patch, { foo: [ValueOpType.Put, 'x'] }],
+			})
+			expect(diffRecord(absent, explicitlyUndefined)).toBeNull()
+			expect(diffRecord(explicitlyUndefined, absent)).toBeNull()
+			expect(diffRecord({ a: undefined }, { a: undefined })).toBeNull()
+		})
+
+		it('[D2] only considers own keys, not Object.prototype members', () => {
+			const withCtor = { meta: { constructor: 1, toString: 2 } }
+			const without = { meta: {} }
+
+			expect(diffRecord(withCtor, without)).toEqual({
+				meta: [
+					ValueOpType.Patch,
+					{ constructor: [ValueOpType.Delete], toString: [ValueOpType.Delete] },
+				],
+			})
+			expect(diffRecord(without, withCtor)).toEqual({
+				meta: [
+					ValueOpType.Patch,
+					{ constructor: [ValueOpType.Put, 1], toString: [ValueOpType.Put, 2] },
+				],
+			})
+		})
+
+		it('[D2] ignores __proto__ keys, which applyObjectDiff would drop (AD8)', () => {
+			// JSON.parse creates '__proto__' as an own key; diffing it would store it on the server
+			// while peers receive an op they drop
+			const polluted = JSON.parse('{"__proto__":{"evil":1},"meta":{"__proto__":{"evil":1}}}')
+			const clean = { meta: {} }
+
+			expect(diffRecord(clean, polluted)).toBeNull()
+			expect(diffRecord(polluted, clean)).toBeNull()
+		})
 	})
 
 	describe('top-level keys vs props/meta (D3)', () => {
@@ -102,7 +148,8 @@ describe('computing diffs (D)', () => {
 
 			const diff = diffRecord(prev, next)
 			expect(diff).toBeTruthy()
-			expect(diff!.optional).toEqual([ValueOpType.Put, undefined])
+			// undefined is not representable on the wire, so it reads as the key being absent (D2)
+			expect(diff!.optional).toEqual([ValueOpType.Delete])
 			expect(diff!.nullable).toEqual([ValueOpType.Put, 'value'])
 		})
 	})
@@ -378,6 +425,25 @@ describe('computing diffs (D)', () => {
 				arr: [ValueOpType.Patch, { '0': [ValueOpType.Put, null] }],
 			})
 		})
+
+		it('[D6] puts a changed index when an item switches between array and object', () => {
+			// index deletes and named puts don't apply cleanly across shapes, so a patch would
+			// leave the receiver with a sparse array / an object where an array is expected
+			const arrayItem = { meta: { items: [[1, 2]] } }
+			const objectItem = { meta: { items: [{ x: 1 }] } }
+
+			const toObject = diffRecord(arrayItem, objectItem)!
+			expect(toObject).toEqual({
+				meta: [
+					ValueOpType.Patch,
+					{ items: [ValueOpType.Patch, { '0': [ValueOpType.Put, { x: 1 }] }] },
+				],
+			})
+			expect(applyObjectDiff(arrayItem, toObject)).toEqual(objectItem)
+
+			const toArray = diffRecord(objectItem, arrayItem)!
+			expect(applyObjectDiff(objectItem, toArray)).toEqual(arrayItem)
+		})
 	})
 
 	describe('different-length arrays (D7)', () => {
@@ -747,6 +813,30 @@ describe('applying diffs (AD)', () => {
 
 			expect(applyObjectDiff(obj, diff)).toBe(obj)
 		})
+
+		it('[AD5] deleting an inherited key has no effect', () => {
+			const obj = { a: 1 }
+			// `toString` collides with Object.prototype's own member in the literal's type, hence the cast
+			const diff = { toString: [ValueOpType.Delete] } as unknown as ObjectDiff
+
+			expect(applyObjectDiff(obj, diff)).toBe(obj)
+		})
+	})
+
+	describe('untrusted keys (AD8)', () => {
+		it('[AD8] ignores __proto__ keys instead of changing the prototype', () => {
+			// JSON.parse produces '__proto__' as an own key, so a peer can put it in a diff
+			const obj = { a: 1, props: { b: 2 } }
+			const diff: ObjectDiff = JSON.parse(
+				'{"__proto__":["put",{"isAdmin":true}],"props":["patch",{"__proto__":["put",{"polluted":1}]}]}'
+			)
+
+			const result: any = applyObjectDiff(obj, diff)
+			expect(result).toBe(obj)
+			expect(Object.getPrototypeOf(result)).toBe(Object.prototype)
+			expect(result.isAdmin).toBeUndefined()
+			expect(result.props.polluted).toBeUndefined()
+		})
 	})
 
 	describe('patching non-objects (AD6)', () => {

package/src/lib/diff.ts

@@ -1,5 +1,5 @@
 import { RecordsDiff, UnknownRecord } from '@tldraw/store'
-import { isEqual, objectMapEntries, objectMapValues } from '@tldraw/utils'
+import { hasOwnProperty, isEqual, objectMapEntries, objectMapValues } from '@tldraw/utils'
 
 /**
  * Constants representing the types of operations that can be applied to records in network diffs.
@@ -200,15 +200,21 @@ function diffObject(
 		return null
 	}
 	let result: ObjectDiff | null = null
+	// Own-property checks throughout: `in` would see Object.prototype members, so a user key named
+	// e.g. 'constructor' would never diff as an add or delete. And a key whose value is `undefined`
+	// is treated as absent: `undefined` doesn't survive JSON, so `['put', undefined]` would arrive
+	// as `['put', null]` and fail validators that accept only the missing key.
 	for (const key of Object.keys(prev)) {
-		// if key is not in next then it was deleted
-		if (!(key in next)) {
+		// `result['__proto__'] = op` would set the diff's prototype, and applyObjectDiff drops the key (AD8)
+		if (key === '__proto__') continue
+		const prevValue = (prev as any)[key]
+		if (prevValue === undefined) continue
+		const nextValue = hasOwnProperty(next, key) ? (next as any)[key] : undefined
+		if (nextValue === undefined) {
 			if (!result) result = {}
 			result[key] = [ValueOpType.Delete]
 			continue
 		}
-		const prevValue = (prev as any)[key]
-		const nextValue = (next as any)[key]
 		if (
 			nestedKeys?.has(key) ||
 			(Array.isArray(prevValue) && Array.isArray(nextValue)) ||
@@ -226,10 +232,13 @@ function diffObject(
 		}
 	}
 	for (const key of Object.keys(next)) {
+		if (key === '__proto__') continue
+		const nextValue = (next as any)[key]
+		if (nextValue === undefined) continue
 		// if key is in next but not in prev then it was added
-		if (!(key in prev)) {
+		if (!hasOwnProperty(prev, key) || (prev as any)[key] === undefined) {
 			if (!result) result = {}
-			result[key] = [ValueOpType.Put, (next as any)[key]]
+			result[key] = [ValueOpType.Put, nextValue]
 		}
 	}
 	return result
@@ -245,7 +254,15 @@ function diffValue(valueA: unknown, valueB: unknown, legacyAppendMode: boolean):
 			return [ValueOpType.Append, appendedText, valueA.length]
 		}
 		return [ValueOpType.Put, valueB]
-	} else if (!valueA || !valueB || typeof valueA !== 'object' || typeof valueB !== 'object') {
+	} else if (
+		!valueA ||
+		!valueB ||
+		typeof valueA !== 'object' ||
+		typeof valueB !== 'object' ||
+		// an array on one side and a plain object on the other can't be expressed as a patch:
+		// index deletes and named puts don't apply cleanly to either shape
+		Array.isArray(valueA) !== Array.isArray(valueB)
+	) {
 		return isEqual(valueA, valueB) ? null : [ValueOpType.Put, valueB]
 	} else {
 		const diff = diffObject(valueA, valueB, undefined, legacyAppendMode)
@@ -348,6 +365,10 @@ export function applyObjectDiff<T extends object>(object: T, objectDiff: ObjectD
 		}
 	}
 	for (const [key, op] of Object.entries(objectDiff)) {
+		// Diffs come off the wire from untrusted peers. `newObject['__proto__'] = v` would set the
+		// record's prototype (JSON.parse creates '__proto__' as an own key), so a client could give
+		// server-held records attacker-controlled inherited fields; skip such keys outright.
+		if (key === '__proto__') continue
 		switch (op[0]) {
 			case ValueOpType.Put: {
 				const value = op[1]
@@ -383,7 +404,7 @@ export function applyObjectDiff<T extends object>(object: T, objectDiff: ObjectD
 				break
 			}
 			case ValueOpType.Delete: {
-				if (key in object) {
+				if (hasOwnProperty(object, key)) {
 					if (!newObject) {
 						if (isArray) {
 							console.error("Can't delete array item yet (this should never happen)")

package/src/test/TLSocketRoom.test.ts

@@ -21,7 +21,7 @@ import {
 	ZERO_INDEX_KEY,
 } from 'tldraw'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { MAX_ASSEMBLED_MESSAGE_CHARS } from '../lib/chunk'
+import { chunk, MAX_ASSEMBLED_MESSAGE_CHARS } from '../lib/chunk'
 import { RecordOpType } from '../lib/diff'
 import { DEFAULT_INITIAL_SNAPSHOT, InMemorySyncStorage } from '../lib/InMemorySyncStorage'
 import { getTlsyncProtocolVersion } from '../lib/protocol'
@@ -454,6 +454,75 @@ describe('28. TLSocketRoom (SR)', () => {
 			expect(room.getSessions()).toHaveLength(0)
 		})
 
+		it('[SR5] ignores chunks from a superseded socket so they do not corrupt the replacement socket', () => {
+			const log: TLSyncLog = { warn: vi.fn(), error: vi.fn() }
+			const room = new TLSocketRoom({ log })
+			const oldSocket = createMockSocket()
+			connectSession(room, 'S', oldSocket)
+			// the client reconnects under the same session id while the old socket is still draining
+			const newSocket = createMockSocket()
+			connectSession(room, 'S', newSocket)
+			vi.mocked(newSocket.send).mockClear()
+
+			const oldChunks = chunk(JSON.stringify({ type: 'ping' }), 4)
+			const newChunks = chunk(JSON.stringify({ type: 'ping' }), 5)
+			expect(oldChunks.length).toBeGreaterThan(1)
+			expect(newChunks.length).toBeGreaterThan(1)
+			// interleave the two sockets' chunk sequences, as a hibernation host delivers them
+			for (let i = 0; i < Math.max(oldChunks.length, newChunks.length); i++) {
+				if (oldChunks[i]) room.handleSocketMessage('S', oldChunks[i], oldSocket)
+				if (newChunks[i]) room.handleSocketMessage('S', newChunks[i], newSocket)
+			}
+			// a lone complete message from the old socket mid-sequence is ignored too
+			room.handleSocketMessage('S', JSON.stringify({ type: 'ping' }), oldSocket)
+
+			expect(log.error).not.toHaveBeenCalled()
+			expect(newSocket.close).not.toHaveBeenCalled()
+			expect(room.getSessions()).toEqual([
+				expect.objectContaining({ sessionId: 'S', isConnected: true }),
+			])
+			expect(vi.mocked(newSocket.send).mock.calls.map((c) => JSON.parse(c[0]).type)).toEqual([
+				'pong',
+			])
+		})
+
+		it("[SR4][SR5] the listeners attached by handleSocketConnect drop a superseded socket's messages", () => {
+			function createListeningSocket() {
+				const listeners: Record<string, ((e: any) => void)[]> = {}
+				const socket: WebSocketMinimal & { fire(type: string, data: string): void } = {
+					send: vi.fn(),
+					close: vi.fn(),
+					readyState: WebSocket.OPEN,
+					addEventListener: vi.fn((type: string, fn: (e: any) => void) => {
+						;(listeners[type] ??= []).push(fn)
+					}),
+					removeEventListener: vi.fn(),
+					fire(type, data) {
+						for (const fn of listeners[type] ?? []) fn({ data })
+					},
+				}
+				return socket
+			}
+			const log: TLSyncLog = { warn: vi.fn(), error: vi.fn() }
+			const room = new TLSocketRoom({ log })
+			const oldSocket = createListeningSocket()
+			connectSession(room, 'S', oldSocket)
+			const newSocket = createListeningSocket()
+			connectSession(room, 'S', newSocket)
+
+			const [first, ...rest] = chunk(JSON.stringify({ type: 'ping' }), 5)
+			newSocket.fire('message', first)
+			// the old socket's tail chunk would otherwise be assembled onto the new socket's sequence
+			oldSocket.fire('message', '0_kPAAAjzgAA')
+			for (const c of rest) newSocket.fire('message', c)
+
+			expect(log.error).not.toHaveBeenCalled()
+			expect(newSocket.close).not.toHaveBeenCalled()
+			expect(vi.mocked(newSocket.send).mock.calls.map((c) => JSON.parse(c[0]).type)).toContain(
+				'pong'
+			)
+		})
+
 		it('[SR5] warns when receiving a message from an unknown session', () => {
 			const log: TLSyncLog = { warn: vi.fn(), error: vi.fn() }
 			const room = new TLSocketRoom({ log })
@@ -585,6 +654,68 @@ describe('28. TLSocketRoom (SR)', () => {
 			expect(room.getSessions()[0].isConnected).toBe(false)
 			expect(socket.close).toHaveBeenCalled()
 		})
+
+		it.each(['handleSocketClose', 'handleSocketError'] as const)(
+			"[SR6][SR12] %s ignores a superseded socket's late event after a same-id reconnect",
+			(method) => {
+				vi.useFakeTimers()
+				try {
+					const onSessionSnapshot = vi.fn()
+					const room = new TLSocketRoom({ onSessionSnapshot })
+					const oldSocket = createMockSocket()
+					connectSession(room, 'S', oldSocket)
+					const newSocket = createMockSocket()
+					connectSession(room, 'S', newSocket)
+
+					room[method]('S', oldSocket)
+
+					expect(room.getSessions()).toEqual([
+						expect.objectContaining({ sessionId: 'S', isConnected: true }),
+					])
+					expect(newSocket.close).not.toHaveBeenCalled()
+					// the live session's pending snapshot survives the superseded event
+					vi.advanceTimersByTime(5100)
+					expect(onSessionSnapshot).toHaveBeenCalledTimes(1)
+
+					room[method]('S', newSocket)
+					expect(room.getSessions()[0].isConnected).toBe(false)
+				} finally {
+					vi.useRealTimers()
+				}
+			}
+		)
+
+		it("[SR4][SR6] a reconnect detaches the previous socket's listeners", () => {
+			const listeners = new Map<string, (e: any) => void>()
+			const oldSocket = createMockSocket({
+				addEventListener: vi.fn((type: string, fn: (e: any) => void) => listeners.set(type, fn)),
+				removeEventListener: vi.fn((type: string, fn: (e: any) => void) => {
+					if (listeners.get(type) === fn) listeners.delete(type)
+				}),
+			})
+			connectSession(room, 'S', oldSocket)
+			expect([...listeners.keys()].sort()).toEqual(['close', 'error', 'message'])
+
+			connectSession(room, 'S', createMockSocket())
+
+			expect(listeners.size).toBe(0)
+		})
+
+		it.each(['close', 'error'] as const)(
+			'[SR4][SR6] firing the attached %s listener cancels the session',
+			(type) => {
+				const listeners = new Map<string, (e: any) => void>()
+				const socket = createMockSocket({
+					addEventListener: vi.fn((t: string, fn: (e: any) => void) => listeners.set(t, fn)),
+				})
+				connectSession(room, 'S', socket)
+
+				listeners.get(type)!(new Event(type))
+
+				expect(room.getSessions()[0].isConnected).toBe(false)
+				expect(socket.close).toHaveBeenCalled()
+			}
+		)
 	})
 
 	describe('session reporting', () => {

package/src/test/TLSyncRoom.test.ts

@@ -2482,6 +2482,130 @@ describe('26. Session lifecycle (SES)', () => {
 		expect(socket.__lastMessage).toEqual({ type: 'pong' })
 	})
 
+	it('[SES5] no session receives string-append ops while a client without append support is connected', () => {
+		vi.useFakeTimers()
+		const { room } = makeRoom()
+		const v8 = connectSession(room, 'v8', { protocolVersion: getTlsyncProtocolVersion() })
+		const v7 = connectSession(room, 'v7', { protocolVersion: 7 })
+		expect(room.getCanEmitStringAppend()).toBe(false)
+
+		const hasAppend = (msg: any) => JSON.stringify(msg).includes('"append"')
+
+		// a full put over an existing record whose only change is a string append
+		room.handleMessage('v8', {
+			type: 'push',
+			clientClock: 1,
+			diff: { [pageRecord.id]: ['put', { ...pageRecord, name: pageRecord.name + ' more' }] },
+		} as TLPushRequest<TLRecord>)
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL + 1)
+		expect(sentDataMessages(v7)).toEqual([
+			{
+				type: 'patch',
+				diff: { [pageRecord.id]: ['patch', { name: ['put', pageRecord.name + ' more'] }] },
+				serverClock: 1,
+			},
+		])
+		expect(sentDataMessages(v8).some(hasAppend)).toBe(false)
+		clearSocket(v7)
+		clearSocket(v8)
+
+		// a patch whose recomputed broadcast would otherwise be an append
+		room.handleMessage('v8', {
+			type: 'push',
+			clientClock: 2,
+			diff: { [pageRecord.id]: ['patch', { name: ['put', pageRecord.name + ' more and more'] }] },
+		} as TLPushRequest<TLRecord>)
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL + 1)
+		expect(sentDataMessages(v7)).toEqual([
+			{
+				type: 'patch',
+				diff: {
+					[pageRecord.id]: ['patch', { name: ['put', pageRecord.name + ' more and more'] }],
+				},
+				serverClock: 2,
+			},
+		])
+		expect(sentDataMessages(v8)).toEqual([
+			{ type: 'push_result', clientClock: 2, serverClock: 2, action: 'commit' },
+		])
+	})
+
+	it('[SES6] handleResumedSession rejects a session whose schema the server can no longer reconcile', () => {
+		const { room } = makeRoom()
+		const socket = makeSocket()
+		const newerSchema: SerializedSchemaV2 = {
+			schemaVersion: 2,
+			sequences: {
+				...(room.serializedSchema as SerializedSchemaV2).sequences,
+				'com.tldraw.store': 999,
+			},
+		}
+
+		room.handleResumedSession({
+			sessionId: 'resumed',
+			socket,
+			meta: undefined,
+			isReadonly: false,
+			serializedSchema: newerSchema,
+			presenceId: null,
+			presenceRecord: null,
+			requiresLegacyRejection: false,
+			supportsStringAppend: true,
+		})
+
+		expect(room.sessions.has('resumed')).toBe(false)
+		expect(socket.close).toHaveBeenCalledWith(
+			TLSyncErrorCloseEventCode,
+			TLSyncErrorCloseEventReason.SERVER_TOO_OLD
+		)
+	})
+
+	it('[SES6] rejecting a resumed session removes its restored presence for other sessions', () => {
+		vi.useFakeTimers()
+		const { room } = makeRoom()
+		const makePresence = (name: string) =>
+			InstancePresenceRecordType.create({
+				id: InstancePresenceRecordType.createId(name),
+				currentPageId: pageRecord.id,
+				userId: createUserId(name),
+				userName: name,
+			})
+		const resume = (sessionId: string, serializedSchema: SerializedSchema) => {
+			const socket = makeSocket()
+			const presenceRecord = makePresence(sessionId)
+			room.handleResumedSession({
+				sessionId,
+				socket,
+				meta: undefined,
+				isReadonly: false,
+				serializedSchema,
+				presenceId: presenceRecord.id,
+				presenceRecord,
+				requiresLegacyRejection: false,
+				supportsStringAppend: true,
+			})
+			return { socket, presenceId: presenceRecord.id }
+		}
+
+		const other = resume('other', room.serializedSchema)
+		const rejected = resume('rejected', {
+			schemaVersion: 2,
+			sequences: {
+				...(room.serializedSchema as SerializedSchemaV2).sequences,
+				'com.tldraw.store': 999,
+			},
+		})
+		vi.advanceTimersByTime(DATA_MESSAGE_DEBOUNCE_INTERVAL * 2)
+
+		expect(room.sessions.has('rejected')).toBe(false)
+		expect(room.presenceStore.get(rejected.presenceId)).toBeUndefined()
+		// other clients still hold this presence from before the socket slept
+		expect(sentDataMessages(other.socket).at(-1)).toMatchObject({
+			type: 'patch',
+			diff: { [rejected.presenceId]: [RecordOpType.Remove] },
+		})
+	})
+
 	it('[SES7] a message from an unknown session id logs a warning and is ignored', () => {
 		const warn = vi.fn()
 		const { room } = makeRoom({ log: { warn } })

package/src/test/upgradeDowngrade.test.ts

@@ -413,6 +413,27 @@ it('[HS3] out-of-date clients will receive incompatibility errors', () => {
 	expect(socket.close).toHaveBeenCalledWith(4099, TLSyncErrorCloseEventReason.CLIENT_TOO_OLD)
 })
 
+it.each([
+	['a v2 schema without sequences', { schemaVersion: 2 }],
+	['a v2 schema with null sequences', { schemaVersion: 2, sequences: null }],
+	['a null schema', null],
+])('[HS3] clients sending %s are rejected as too old', (_, schema) => {
+	const server = new TestServer(schemaV3)
+	const id = 'test_malformed_schema'
+	const socket = mockSocket()
+
+	server.room.handleNewSession({ sessionId: id, socket, meta: undefined, isReadonly: false })
+	server.room.handleMessage(id, {
+		type: 'connect',
+		connectRequestId: 'test',
+		lastServerClock: 0,
+		protocolVersion: getTlsyncProtocolVersion(),
+		schema: schema as any,
+	})
+
+	expect(socket.close).toHaveBeenCalledWith(4099, TLSyncErrorCloseEventReason.CLIENT_TOO_OLD)
+})
+
 it('[HS2] clients using an out-of-date protocol will receive compatibility errors', () => {
 	const actualVersion = getTlsyncProtocolVersion()
 	mockGetTlsyncProtocolVersion.mockReturnValue(actualVersion + 1)