appium-webdriveragent 16.13.1 → 16.13.3

package/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [16.13.3](https://github.com/appium/WebDriverAgent/compare/v16.13.2...v16.13.3) (2026-09-30)
+
+### Bug Fixes
+
+* reject stale sessions without retaining past responses ([#1282](https://github.com/appium/WebDriverAgent/issues/1282)) ([f245ffb](https://github.com/appium/WebDriverAgent/commit/f245ffb4e6906143384410cf312abc5bcedf5486))
+
+## [16.13.2](https://github.com/appium/WebDriverAgent/compare/v16.13.1...v16.13.2) (2026-09-30)
+
+### Bug Fixes
+
+* process received HTTP bytes before handling EOF ([#1277](https://github.com/appium/WebDriverAgent/issues/1277)) ([203fc4f](https://github.com/appium/WebDriverAgent/commit/203fc4f012ab1d90caf0127fe85f119ad85cb0e8))
+
 ## [16.13.1](https://github.com/appium/WebDriverAgent/compare/v16.13.0...v16.13.1) (2026-09-30)
 
 ### Performance Improvements

package/WebDriverAgentLib/Info.plist

@@ -15,11 +15,11 @@
     <key>CFBundlePackageType</key>
     <string>FMWK</string>
     <key>CFBundleShortVersionString</key>
-    <string>16.13.1</string>
+    <string>16.13.3</string>
     <key>CFBundleSignature</key>
     <string>????</string>
     <key>CFBundleVersion</key>
-    <string>16.13.1</string>
+    <string>16.13.3</string>
     <key>NSPrincipalClass</key>
     <string/>
   </dict>

package/WebDriverAgentLib/Routing/FBHTTPServer.m

@@ -13,6 +13,7 @@
 #import "FBLogger.h"
 #import "FBResponsePayload.h"
 #import "FBTCPSocket.h"
+#import "FBSession.h"
 
 static NSData *FBCRLFCRLFData(void)
 {
@@ -131,10 +132,6 @@ static BOOL FBParseContentLength(NSString *value, NSUInteger *outLength)
 // standalone or not (except DELETE /session itself - see -dispatchMethod:). See
 // -abandonPendingRequestsForSessionID:. Guarded by @synchronized(self.pendingSessionRequests).
 @property (nonatomic, strong) NSMutableDictionary<NSString *, NSMutableSet<FBPendingRequest *> *> *pendingSessionRequests;
-// Already-abandoned sessions mapped to the response they were abandoned with, so a request parsed
-// after that point is answered at once instead of queueing for a session that is gone. Kept for
-// the server's lifetime; ids are UUIDs. Guarded by @synchronized(self.pendingSessionRequests).
-@property (nonatomic, strong) NSMutableDictionary<NSString *, RouteResponse *> *abandonedSessionResponses;
 // When each connection started waiting for its current request. The reaper closes connections
 // whose entry outlives FBIncompleteRequestTimeout; idle keep-alive connections have no entry and
 // are exempt. Guarded by @synchronized(self.connectionBuffers).
@@ -163,7 +160,6 @@ static const int64_t FBStaleConnectionSweepIntervalSec = 10;
     _connectionsAwaitingResponse = [NSMutableSet set];
     _standaloneWaiters = [NSMutableDictionary dictionary];
     _pendingSessionRequests = [NSMutableDictionary dictionary];
-    _abandonedSessionResponses = [NSMutableDictionary dictionary];
     _incompleteRequestStarts = [NSMapTable mapTableWithKeyOptions:(NSPointerFunctionsOptions)(NSMapTableObjectPointerPersonality | NSMapTableStrongMemory)
                                                      valueOptions:(NSPointerFunctionsOptions)NSMapTableStrongMemory];
   }
@@ -340,18 +336,28 @@ static const int64_t FBStaleConnectionSweepIntervalSec = 10;
 
 - (void)didClientDisconnect:(nw_connection_t)client
 {
-  BOOL isAwaitingResponse;
-  @synchronized (self.connectionBuffers) {
-    isAwaitingResponse = [self.connectionsAwaitingResponse containsObject:client];
-    [self.connectionBuffers removeObjectForKey:client];
-    [self.pendingRequestHeaders removeObjectForKey:client];
-    [self.incompleteRequestStarts removeObjectForKey:client];
-  }
-  // A client that only stopped sending may still read the response to its in-flight request, so
-  // that response's send completion closes the connection instead (it finds no buffer left).
-  if (!isAwaitingResponse) {
-    nw_connection_cancel(client);
-  }
+  // EOF must follow every receive already queued for this client. Otherwise it can
+  // remove the buffer before those bytes have even been appended and parsed.
+  __weak typeof(self) weakSelf = self;
+  dispatch_async(self.bufferProcessingQueue, ^{
+    __strong typeof(weakSelf) strongSelf = weakSelf;
+    if (nil == strongSelf) {
+      nw_connection_cancel(client);
+      return;
+    }
+    BOOL isAwaitingResponse;
+    @synchronized (strongSelf.connectionBuffers) {
+      isAwaitingResponse = [strongSelf.connectionsAwaitingResponse containsObject:client];
+      [strongSelf.connectionBuffers removeObjectForKey:client];
+      [strongSelf.pendingRequestHeaders removeObjectForKey:client];
+      [strongSelf.incompleteRequestStarts removeObjectForKey:client];
+    }
+    // A client that only stopped sending may still read the response to its in-flight request, so
+    // that response's send completion closes the connection instead (it finds no buffer left).
+    if (!isAwaitingResponse) {
+      nw_connection_cancel(client);
+    }
+  });
 }
 
 - (void)client:(nw_connection_t)client didReceiveData:(NSData *)data
@@ -729,9 +735,15 @@ static const int64_t FBStaleConnectionSweepIntervalSec = 10;
 - (nullable RouteResponse *)trackPendingRequest:(FBPendingRequest *)pendingRequest forSessionID:(NSString *)sessionID
 {
   @synchronized (self.pendingSessionRequests) {
-    RouteResponse *abandonedResponse = self.abandonedSessionResponses[sessionID];
-    if (nil != abandonedResponse) {
-      return abandonedResponse;
+    // Checking the current session under this lock closes the admission/teardown
+    // race without retaining a tombstone and a full response for every past UUID.
+    // -kill clears the active session before posting its abandonment notification.
+    if (nil == [FBSession sessionWithIdentifier:sessionID]) {
+      RouteResponse *response = [RouteResponse new];
+      [FBResponseWithStatus([FBCommandStatus noSuchDriverErrorWithMessage:@"Session does not exist"
+                                                               traceback:nil]) dispatchWithResponse:response];
+      [self applyDefaultHeadersToResponse:response];
+      return response;
     }
     NSMutableSet<FBPendingRequest *> *pendingRequests = self.pendingSessionRequests[sessionID];
     if (nil == pendingRequests) {
@@ -766,8 +778,6 @@ static const int64_t FBStaleConnectionSweepIntervalSec = 10;
   @synchronized (self.pendingSessionRequests) {
     pendingRequests = [self.pendingSessionRequests[sessionID] copy];
     [self.pendingSessionRequests removeObjectForKey:sessionID];
-    // Recorded before the lock is dropped, so requests admitted from here on are rejected.
-    self.abandonedSessionResponses[sessionID] = response;
   }
   for (FBPendingRequest *pendingRequest in pendingRequests) {
     [self writeResponse:response toClient:pendingRequest.client];

package/WebDriverAgentTests/UnitTests/FBHTTPServerSessionTests.m

@@ -13,6 +13,7 @@
 #import <sys/socket.h>
 
 #import "FBHTTPServer.h"
+#import "FBSession-Private.h"
 
 static atomic_int gSessionProbeHits;
 
@@ -23,10 +24,26 @@ static atomic_int gSessionProbeHits;
 
 @implementation FBHTTPServerSessionTests
 
+- (void)testAbandonmentDoesNotRetainResponsesAfterPendingRequestsDrain
+{
+  __weak RouteResponse *weakResponse;
+  @autoreleasepool {
+    RouteResponse *response = [RouteResponse new];
+    [response respondWithString:@"deleted"];
+    weakResponse = response;
+    for (NSUInteger index = 0; index < 1000; index++) {
+      [self.server abandonPendingRequestsForSessionID:[NSString stringWithFormat:@"old-%lu", (unsigned long)index]
+                                         withResponse:response];
+    }
+  }
+  XCTAssertNil(weakResponse);
+}
+
 - (void)setUp
 {
   [super setUp];
   atomic_store(&gSessionProbeHits, 0);
+  [FBSession initWithApplication:nil].identifier = @"live-session";
   self.server = [FBHTTPServer new];
   [self.server get:@"/session/:sessionID/probe" withBlock:^(RouteRequest *request, RouteResponse *response) {
     atomic_fetch_add(&gSessionProbeHits, 1);
@@ -42,6 +59,7 @@ static atomic_int gSessionProbeHits;
 {
   [self.server stop:NO];
   self.server = nil;
+  [FBSession.activeSession kill];
   [super tearDown];
 }
 
@@ -93,14 +111,14 @@ static atomic_int gSessionProbeHits;
 
   NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[@"GET /session/dead-session/probe HTTP/1.1\r\n\r\n" dataUsingEncoding:NSUTF8StringEncoding]
                                             timeout:5.0];
-  XCTAssertTrue([response containsString:@"session-was-deleted"], @"%@", response);
+  XCTAssertTrue([response containsString:@"invalid session id"], @"%@", response);
   XCTAssertEqual(atomic_load(&gSessionProbeHits), 0, @"the route must not run for a deleted session");
 }
 
 - (void)testAbandonedSessionIsRememberedAfterManyLaterAbandonments
 {
-  // Abandoned ids are kept for the server's lifetime; evicting them would let a stale request
-  // queue on a possibly wedged route queue again, which is the hang this rejection prevents.
+  // A stale UUID must still be rejected after arbitrarily many other sessions,
+  // without needing to remember every deleted UUID.
   RouteResponse *abandonedResponse = [RouteResponse new];
   [abandonedResponse respondWithString:@"session-was-deleted"];
   [self.server abandonPendingRequestsForSessionID:@"dead-session" withResponse:abandonedResponse];
@@ -113,7 +131,7 @@ static atomic_int gSessionProbeHits;
 
   NSString *response = [self responseForRawPayload:(NSData * _Nonnull)[@"GET /session/dead-session/probe HTTP/1.1\r\n\r\n" dataUsingEncoding:NSUTF8StringEncoding]
                                             timeout:5.0];
-  XCTAssertTrue([response containsString:@"session-was-deleted"], @"%@", response);
+  XCTAssertTrue([response containsString:@"invalid session id"], @"%@", response);
   XCTAssertEqual(atomic_load(&gSessionProbeHits), 0, @"the route must not run for a deleted session");
 }
 

package/WebDriverAgentTests/UnitTests/FBHTTPServerTests.m

@@ -14,6 +14,7 @@
 #import <unistd.h>
 
 #import "FBHTTPServer.h"
+#import "FBTCPSocket.h"
 
 static atomic_int gFramingProbeHits;
 
@@ -242,6 +243,32 @@ static NSString *FBCompleteResponse(NSData *data)
   XCTAssertEqual([self serverSocketCountSettlingAt:baseline], baseline);
 }
 
+- (void)testEofWaitsForPreviouslyReceivedBytesToBeParsed
+{
+  FBHTTPServer *server = [FBHTTPServer new];
+  __block NSUInteger calls = 0;
+  [server get:@"/probe" withBlock:^(RouteRequest *request, RouteResponse *response) {
+    calls++;
+  }];
+  dispatch_queue_t queue = [server valueForKey:@"bufferProcessingQueue"];
+  nw_connection_t client = nw_connection_create(nw_endpoint_create_host("127.0.0.1", "1"),
+    nw_parameters_create_secure_tcp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION));
+  id<FBTCPSocketDelegate> delegate = (id)server;
+  [delegate didClientConnect:client];
+  dispatch_suspend(queue);
+  @try {
+    NSData *data = [@"GET /probe HTTP/1.1\r\n\r\n" dataUsingEncoding:NSUTF8StringEncoding];
+    [delegate client:client didReceiveData:data];
+    [delegate didClientDisconnect:client];
+  } @finally {
+    dispatch_resume(queue);
+  }
+  dispatch_sync(queue, ^{});
+  XCTAssertEqual(calls, 1u);
+  [server stop:YES];
+  nw_connection_cancel(client);
+}
+
 - (void)testHalfClosedClientGetsItsResponseAndIsThenClosed
 {
   // A client may shut down its sending side right after the request and wait for the response.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appium-webdriveragent",
-  "version": "16.13.1",
+  "version": "16.13.3",
   "description": "Package bundling WebDriverAgent",
   "keywords": [
     "Appium",