appium-webdriveragent 16.7.1 → 16.7.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [16.7.2](https://github.com/appium/WebDriverAgent/compare/v16.7.1...v16.7.2) (2026-08-24)
+
+### Bug Fixes
+
+* harden FBHTTPServer/FBTCPSocket against races and protocol gaps ([#1224](https://github.com/appium/WebDriverAgent/issues/1224)) ([cf4bb2b](https://github.com/appium/WebDriverAgent/commit/cf4bb2b57b4d3a55ee4bbe8f860b00b0e7f5a326))
+
 ## [16.7.1](https://github.com/appium/WebDriverAgent/compare/v16.7.0...v16.7.1) (2026-08-23)
 
 ### Bug Fixes

package/WebDriverAgentLib/Info.plist

@@ -15,11 +15,11 @@
     <key>CFBundlePackageType</key>
     <string>FMWK</string>
     <key>CFBundleShortVersionString</key>
-    <string>16.7.1</string>
+    <string>16.7.2</string>
     <key>CFBundleSignature</key>
     <string>????</string>
     <key>CFBundleVersion</key>
-    <string>16.7.1</string>
+    <string>16.7.2</string>
     <key>NSPrincipalClass</key>
     <string/>
   </dict>

package/WebDriverAgentLib/Routing/FBHTTPServer.h

@@ -9,8 +9,9 @@
 // A minimal HTTP/1.1 server on top of FBTCPSocket (Network.framework-backed on every platform,
 // since watchOS forbids BSD sockets outright - see FBTCPSocket.h/.m).
 //
-// No chunked encoding, range requests, or pipelining - just request line + headers +
-// Content-Length body, and ":param" path matching.
+// No range requests or request pipelining - just request line + headers + Content-Length body,
+// and ":param" path matching. Any Transfer-Encoding is rejected outright (501) rather than
+// silently mishandled, since no decoder is implemented.
 
 @import Foundation;
 

package/WebDriverAgentLib/Routing/FBHTTPServer.m

@@ -41,6 +41,20 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
 @end
 
 
+// Cached result of parsing a connection's request line + headers, kept around while its body is
+// still streaming in so a slow body doesn't cause the header block to be re-found and re-parsed
+// on every single incoming TCP segment.
+@interface FBPendingHTTPRequestHeader : NSObject
+@property (nonatomic, copy) NSString *method;
+@property (nonatomic, copy) NSString *pathAndQuery;
+@property (nonatomic) NSUInteger bodyStart;
+@property (nonatomic) NSUInteger contentLength;
+@end
+
+@implementation FBPendingHTTPRequestHeader
+@end
+
+
 @interface FBHTTPServer () <FBTCPSocketDelegate>
 
 @property (nonatomic, nullable, strong) FBTCPSocket *socket;
@@ -50,6 +64,9 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
 @property (nonatomic, copy, nullable) NSString *interface;
 // nw_connection_t isn't NSCopying, so it can't be an NSDictionary key - use NSMapTable instead.
 @property (nonatomic, strong) NSMapTable<id, NSMutableData *> *connectionBuffers;
+// Per-client cache of the already-parsed request line + headers while its body is still
+// arriving; nil while a client's next unread bytes start with an unparsed header block.
+@property (nonatomic, strong) NSMapTable<id, FBPendingHTTPRequestHeader *> *pendingRequestHeaders;
 
 @end
 
@@ -62,6 +79,8 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
     _defaultHeaders = [NSMutableDictionary dictionary];
     _connectionBuffers = [NSMapTable mapTableWithKeyOptions:(NSPointerFunctionsOptions)(NSMapTableObjectPointerPersonality | NSMapTableStrongMemory)
                                                  valueOptions:(NSPointerFunctionsOptions)NSMapTableStrongMemory];
+    _pendingRequestHeaders = [NSMapTable mapTableWithKeyOptions:(NSPointerFunctionsOptions)(NSMapTableObjectPointerPersonality | NSMapTableStrongMemory)
+                                                    valueOptions:(NSPointerFunctionsOptions)NSMapTableStrongMemory];
   }
   return self;
 }
@@ -103,6 +122,7 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
                                                                                  error:nil];
   NSMutableString *regexPath = [NSMutableString stringWithString:escapedPath];
   __block NSInteger diff = 0;
+  __block NSUInteger wildcardIndex = 0;
   [paramRegex enumerateMatchesInString:escapedPath
                                 options:(NSMatchingOptions)0
                                   range:NSMakeRange(0, escapedPath.length)
@@ -111,7 +131,11 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
     NSString *capturedString = [escapedPath substringWithRange:result.range];
     NSString *replacementString;
     if ([capturedString isEqualToString:@"*"]) {
-      [keys addObject:@"wildcards"];
+      // Only the first wildcard keeps the plain "wildcards" name - later ones get an index
+      // suffix so multiple "*" segments in one path don't overwrite each other's capture.
+      NSString *wildcardKey = 0 == wildcardIndex ? @"wildcards" : [NSString stringWithFormat:@"wildcards%lu", (unsigned long)wildcardIndex];
+      wildcardIndex++;
+      [keys addObject:wildcardKey];
       replacementString = @"(.*?)";
     } else {
       NSString *keyString = [escapedPath substringWithRange:[result rangeAtIndex:2]];
@@ -166,6 +190,7 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
   self.socket = nil;
   @synchronized (self.connectionBuffers) {
     [self.connectionBuffers removeAllObjects];
+    [self.pendingRequestHeaders removeAllObjects];
   }
   _isRunning = NO;
 }
@@ -183,6 +208,7 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
 {
   @synchronized (self.connectionBuffers) {
     [self.connectionBuffers removeObjectForKey:client];
+    [self.pendingRequestHeaders removeObjectForKey:client];
   }
 }
 
@@ -205,72 +231,130 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
 {
   while (YES) {
     NSMutableData *buffer;
+    FBPendingHTTPRequestHeader *pending;
     @synchronized (self.connectionBuffers) {
       buffer = [self.connectionBuffers objectForKey:client];
-    }
-    if (nil == buffer) {
-      return;
+      if (nil == buffer) {
+        return;
+      }
+      pending = [self.pendingRequestHeaders objectForKey:client];
     }
 
-    NSRange headerEndRange = [buffer rangeOfData:FBCRLFCRLFData() options:(NSDataSearchOptions)0 range:NSMakeRange(0, buffer.length)];
-    if (NSNotFound == headerEndRange.location) {
-      return;
-    }
+    if (nil == pending) {
+      NSRange headerEndRange = [buffer rangeOfData:FBCRLFCRLFData() options:(NSDataSearchOptions)0 range:NSMakeRange(0, buffer.length)];
+      if (NSNotFound == headerEndRange.location) {
+        // Wait for the rest of the header block to arrive.
+        return;
+      }
 
-    NSData *headerData = [buffer subdataWithRange:NSMakeRange(0, headerEndRange.location)];
-    NSString *headerString = [[NSString alloc] initWithData:headerData encoding:NSUTF8StringEncoding];
-    NSArray<NSString *> *lines = [headerString componentsSeparatedByString:@"\r\n"];
-    if (lines.count < 1) {
-      [self closeClient:client];
-      return;
-    }
+      NSData *headerData = [buffer subdataWithRange:NSMakeRange(0, headerEndRange.location)];
+      NSString *headerString = [[NSString alloc] initWithData:headerData encoding:NSUTF8StringEncoding];
+      NSArray<NSString *> *lines = [headerString componentsSeparatedByString:@"\r\n"];
+      if (lines.count < 1) {
+        [self respondBadRequestToClient:client];
+        return;
+      }
 
-    NSArray<NSString *> *requestLineParts = [lines.firstObject componentsSeparatedByString:@" "];
-    if (requestLineParts.count < 2) {
-      [self closeClient:client];
-      return;
-    }
-    NSString *method = requestLineParts[0].uppercaseString;
-    NSString *pathAndQuery = requestLineParts[1];
-
-    NSMutableDictionary<NSString *, NSString *> *requestHeaders = [NSMutableDictionary dictionary];
-    for (NSUInteger i = 1; i < lines.count; i++) {
-      NSString *line = lines[i];
-      NSRange colonRange = [line rangeOfString:@":"];
-      if (NSNotFound == colonRange.location) {
-        continue;
+      NSArray<NSString *> *requestLineParts = [lines.firstObject componentsSeparatedByString:@" "];
+      if (requestLineParts.count < 2) {
+        [self respondBadRequestToClient:client];
+        return;
       }
-      NSString *name = [line substringToIndex:colonRange.location];
-      NSString *value = [[line substringFromIndex:colonRange.location + 1]
-                          stringByTrimmingCharactersInSet:NSCharacterSet.whitespaceCharacterSet];
-      requestHeaders[name.lowercaseString] = value;
-    }
 
-    NSUInteger contentLength = (NSUInteger)requestHeaders[@"content-length"].integerValue;
-    if (contentLength > FBConfiguration.sharedInstance.httpRequestBodySizeLimit) {
-      // Mirrors CocoaHTTPServer's maxRequestBodySize enforcement. Closes the connection after
-      // responding, since the rest of the oversized body is still incoming.
-      RouteResponse *tooLarge = [RouteResponse new];
-      tooLarge.statusCode = kHTTPStatusCodeRequestEntityTooLarge;
-      [tooLarge respondWithString:@"Request Entity Too Large"];
-      [self writeResponse:tooLarge toClient:client thenCloseConnection:YES];
-      return;
+      NSMutableDictionary<NSString *, NSString *> *requestHeaders = [NSMutableDictionary dictionary];
+      for (NSUInteger i = 1; i < lines.count; i++) {
+        NSString *line = lines[i];
+        NSRange colonRange = [line rangeOfString:@":"];
+        if (NSNotFound == colonRange.location) {
+          continue;
+        }
+        NSString *name = [line substringToIndex:colonRange.location];
+        NSString *value = [[line substringFromIndex:colonRange.location + 1]
+                            stringByTrimmingCharactersInSet:NSCharacterSet.whitespaceCharacterSet];
+        requestHeaders[name.lowercaseString] = value;
+      }
+
+      NSString *transferEncoding = requestHeaders[@"transfer-encoding"];
+      if (transferEncoding.length > 0) {
+        // No transfer decoder is implemented at all, so any encoding (chunked or otherwise -
+        // including a value only introduced by a duplicate header overwriting "chunked" above)
+        // is rejected rather than risking the body being misread as empty and desyncing the rest
+        // of the connection's request stream.
+        RouteResponse *notImplemented = [RouteResponse new];
+        id<FBResponsePayload> notImplementedPayload = FBResponseWithStatus([FBCommandStatus unknownCommandErrorWithMessage:@"Transfer-Encoding is not supported"
+                                                                                                                  traceback:nil]);
+        [notImplementedPayload dispatchWithResponse:notImplemented];
+        [self failClient:client withResponse:notImplemented];
+        return;
+      }
+
+      NSUInteger contentLength = (NSUInteger)requestHeaders[@"content-length"].integerValue;
+      if (contentLength > FBConfiguration.sharedInstance.httpRequestBodySizeLimit) {
+        // Mirrors CocoaHTTPServer's maxRequestBodySize enforcement. Closes the connection after
+        // responding, since the rest of the oversized body is still incoming.
+        RouteResponse *tooLarge = [RouteResponse new];
+        id<FBResponsePayload> tooLargePayload = FBResponseWithStatus([FBCommandStatus unknownCommandErrorWithMessage:@"Request Entity Too Large"
+                                                                                                            traceback:nil]);
+        [tooLargePayload dispatchWithResponse:tooLarge];
+        [self failClient:client withResponse:tooLarge];
+        return;
+      }
+
+      pending = [FBPendingHTTPRequestHeader new];
+      pending.method = requestLineParts[0].uppercaseString;
+      pending.pathAndQuery = requestLineParts[1];
+      pending.bodyStart = headerEndRange.location + headerEndRange.length;
+      pending.contentLength = contentLength;
+      @synchronized (self.connectionBuffers) {
+        [self.pendingRequestHeaders setObject:pending forKey:client];
+      }
     }
-    NSUInteger bodyStart = headerEndRange.location + headerEndRange.length;
-    NSUInteger totalRequestLength = bodyStart + contentLength;
+
+    NSUInteger totalRequestLength = pending.bodyStart + pending.contentLength;
     if (buffer.length < totalRequestLength) {
-      // Wait for the rest of the body to arrive.
+      // Wait for the rest of the body to arrive - the parsed header stays cached above, so this
+      // doesn't re-scan/re-parse the header block on every subsequently arriving chunk.
       return;
     }
 
-    NSData *body = contentLength > 0 ? [buffer subdataWithRange:NSMakeRange(bodyStart, contentLength)] : [NSData data];
+    NSData *body = pending.contentLength > 0 ? [buffer subdataWithRange:NSMakeRange(pending.bodyStart, pending.contentLength)] : [NSData data];
 
     @synchronized (self.connectionBuffers) {
       [buffer replaceBytesInRange:NSMakeRange(0, totalRequestLength) withBytes:NULL length:0];
+      [self.pendingRequestHeaders removeObjectForKey:client];
     }
 
-    [self dispatchMethod:method pathAndQuery:pathAndQuery body:body client:client];
+    [self dispatchMethod:pending.method pathAndQuery:pending.pathAndQuery body:body client:client];
+  }
+}
+
+// Removes the client's buffered state and responds with a closing error response. Removing the
+// buffer synchronously ensures any request bytes still streaming in for this connection are
+// dropped rather than being re-parsed and re-triggering this same response.
+- (void)failClient:(nw_connection_t)client withResponse:(RouteResponse *)response
+{
+  @synchronized (self.connectionBuffers) {
+    [self.connectionBuffers removeObjectForKey:client];
+    [self.pendingRequestHeaders removeObjectForKey:client];
   }
+  [self applyDefaultHeadersToResponse:response];
+  [self writeResponse:response toClient:client thenCloseConnection:YES];
+}
+
+- (void)respondBadRequestToClient:(nw_connection_t)client
+{
+  RouteResponse *badRequest = [RouteResponse new];
+  id<FBResponsePayload> payload = FBResponseWithStatus([FBCommandStatus unknownCommandErrorWithMessage:@"The request could not be parsed as valid HTTP"
+                                                                                              traceback:nil]);
+  [payload dispatchWithResponse:badRequest];
+  [self failClient:client withResponse:badRequest];
+}
+
+- (void)applyDefaultHeadersToResponse:(RouteResponse *)response
+{
+  [self.defaultHeaders enumerateKeysAndObjectsUsingBlock:^(NSString *field, NSString *value, BOOL *stop) {
+    [response setHeader:field value:value];
+  }];
 }
 
 - (void)dispatchMethod:(NSString *)method pathAndQuery:(NSString *)pathAndQuery body:(NSData *)body client:(nw_connection_t)client
@@ -302,9 +386,7 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
     NSURL *url = [NSURL URLWithString:path] ?: [NSURL URLWithString:@"/"];
     RouteRequest *request = [[RouteRequest alloc] initWithURL:url params:params.copy body:body];
     RouteResponse *response = [RouteResponse new];
-    [self.defaultHeaders enumerateKeysAndObjectsUsingBlock:^(NSString *field, NSString *value, BOOL *stop) {
-      [response setHeader:field value:value];
-    }];
+    [self applyDefaultHeadersToResponse:response];
 
     void (^invoke)(void) = ^{
       route.block(request, response);
@@ -323,6 +405,7 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
   FBCommandStatus *status = [FBCommandStatus unknownCommandErrorWithMessage:nil
                                                                    traceback:nil];
   [FBResponseWithStatus(status) dispatchWithResponse:notFound];
+  [self applyDefaultHeadersToResponse:notFound];
   [self writeResponse:notFound toClient:client];
 }
 
@@ -383,6 +466,8 @@ static NSData * _Nonnull FBUTF8Data(NSString *string)
     return @"Request Timeout";
   } else if (kHTTPStatusCodeRequestEntityTooLarge == statusCode) {
     return @"Request Entity Too Large";
+  } else if (kHTTPStatusCodeNotImplemented == statusCode) {
+    return @"Not Implemented";
   } else if (kHTTPStatusCodeInternalServerError == statusCode) {
     return @"Internal Server Error";
   }

package/WebDriverAgentLib/Routing/FBTCPSocket.m

@@ -78,12 +78,18 @@
       // NSLocalizedDescriptionKey must be a string, not the underlying NSError itself, or
       // -[NSError localizedDescription] crashes trying to treat it as one.
       NSError *underlyingError = nwError ? (NSError *)CFBridgingRelease(nw_error_copy_cf_error(nwError)) : nil;
-      NSMutableDictionary<NSString *, id> *userInfo = [NSMutableDictionary dictionary];
-      userInfo[NSLocalizedDescriptionKey] = underlyingError.localizedDescription ?: @"The TCP listener failed to start";
-      if (underlyingError) {
-        userInfo[NSUnderlyingErrorKey] = underlyingError;
+      if ([underlyingError.domain isEqualToString:NSPOSIXErrorDomain]) {
+        // Surface POSIX errors (e.g. EADDRINUSE) directly, since callers like FBWebServer check
+        // for them by domain/code on the top-level error to decide whether to retry another port.
+        startupError = underlyingError;
+      } else {
+        NSMutableDictionary<NSString *, id> *userInfo = [NSMutableDictionary dictionary];
+        userInfo[NSLocalizedDescriptionKey] = underlyingError.localizedDescription ?: @"The TCP listener failed to start";
+        if (underlyingError) {
+          userInfo[NSUnderlyingErrorKey] = underlyingError;
+        }
+        startupError = [NSError errorWithDomain:@"FBTCPSocket" code:2 userInfo:userInfo];
       }
-      startupError = [NSError errorWithDomain:@"FBTCPSocket" code:2 userInfo:userInfo];
       dispatch_semaphore_signal(startupSemaphore);
     }
   });
@@ -98,6 +104,10 @@
     if (error) {
       *error = startupError;
     }
+    // Cancel rather than just dropping our reference - otherwise a late ready/failed callback
+    // can still fire and the port stays bound at the OS level even though the caller was told
+    // startup failed.
+    nw_listener_cancel(listener);
     self.listener = nil;
     return NO;
   }
@@ -144,11 +154,9 @@
     }
     if (nil != content) {
       dispatch_data_t nonnullContent = (dispatch_data_t _Nonnull)content;
-      __block NSData *data = nil;
+      NSMutableData *data = [NSMutableData data];
       dispatch_data_apply(nonnullContent, ^bool(dispatch_data_t  _Nonnull region, size_t offset, const void * _Nonnull buffer, size_t size) {
-        NSMutableData *accumulated = [(data ?: [NSData data]) mutableCopy];
-        [accumulated appendBytes:buffer length:size];
-        data = accumulated.copy;
+        [data appendBytes:buffer length:size];
         return true;
       });
       if (data.length > 0) {
@@ -198,13 +206,19 @@
 
 - (void)stop
 {
+  NSArray<nw_connection_t> *clients;
   @synchronized (self.connectedClients) {
-    NSArray<nw_connection_t> *clients = self.connectedClients.copy;
+    clients = self.connectedClients.copy;
     [self.connectedClients removeAllObjects];
+  }
+  // Cancel on socketQueue, the same queue every connection's send/receive is bound to (see
+  // -acceptConnection:), so a write already issued just before -stop (e.g. a shutdown route's
+  // response) is processed before the cancellation rather than racing it.
+  dispatch_async(self.socketQueue, ^{
     for (nw_connection_t client in clients) {
       nw_connection_cancel(client);
     }
-  }
+  });
 
   self.delegate = nil;
   nw_listener_t listener = self.listener;

package/WebDriverAgentLib/Routing/FBWebServer.m

@@ -261,7 +261,11 @@ static NSString *const FBServerURLEndMarker = @"<-ServerURLHere";
       return;
     }
     [response respondWithString:@"Shutting down"];
-    [strongSelf.delegate webServerDidRequestShutdown:strongSelf];
+    // Deferred so the "Shutting down" response is written to the client before
+    // webServerDidRequestShutdown: tears down the server's socket out from under it.
+    dispatch_async(dispatch_get_main_queue(), ^{
+      [strongSelf.delegate webServerDidRequestShutdown:strongSelf];
+    });
   }];
 
   [self registerRouteHandlers:@[FBUnknownCommands.class]];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "appium-webdriveragent",
-  "version": "16.7.1",
+  "version": "16.7.2",
   "description": "Package bundling WebDriverAgent",
   "keywords": [
     "Appium",