drachtio-srf 5.0.21 → 5.0.23

package/lib/digest-client.js

@@ -42,7 +42,12 @@ module.exports = class DigestClient {
       if (!this.res.has(header)) {
         return callback(new Error(`missing ${header} in ${this.res.statusCode} response`));
       }
-      const challenge = this._parseChallenge(this.res.get(header));
+      const rawChallenge = this.res.get(header);
+      if (typeof rawChallenge !== 'string' || rawChallenge.length === 0) {
+        return callback(new Error(
+          `empty or non-string ${header} value in ${this.res.statusCode} response`));
+      }
+      const challenge = this._parseChallenge(rawChallenge);
 
       const ha1 = crypto.createHash('md5');
       ha1.update([username, challenge.realm, password].join(':'));
@@ -155,13 +160,16 @@ module.exports = class DigestClient {
   }
 
   _parseChallenge(digest) {
+    const params = {};
+    if (typeof digest !== 'string') return params;
     const prefix = 'Digest ';
-    const challenge = digest.substr(digest.indexOf(prefix) + prefix.length);
+    const prefixIdx = digest.indexOf(prefix);
+    if (prefixIdx === -1) return params;
+    const challenge = digest.substr(prefixIdx + prefix.length);
     const parts = challenge.split(',');
     const length = parts.length;
-    const params = {};
     for (let i = 0; i < length; i++) {
-      const part = parts[i].match(/^\s*?([a-zA-Z0-0]+)="?(.*?)"?\s*?$/);
+      const part = parts[i].match(/^\s*?([a-zA-Z0-9]+)="?(.*?)"?\s*?$/);
       if (part && part.length > 2) {
         params[part[1]] = part[2];
       }

package/lib/drachtio-agent.js

@@ -301,7 +301,14 @@ class DrachtioAgent extends Emitter {
           transactionId: transactionId
         };
 
-        const req = new Request(new SipMessage(msg), meta);
+        let sipMsg;
+        try {
+          sipMsg = new SipMessage(msg);
+        } catch(err) {
+          console.error(err, `unable to parse echoed sent request: ${msg}`);
+          return params.callback(err);
+        }
+        const req = new Request(sipMsg, meta);
         req.agent = this;
         req.socket = obj.socket;
         if (params.options.auth) {
@@ -356,7 +363,14 @@ class DrachtioAgent extends Emitter {
       obj.pendingRequests.set(msgId, (token, msg, meta) => {
         obj.pendingRequests.delete(msgId);
         if ('OK' !== token[0]) { if (callback) return callback(token[1]); return; }
-        const responseMsg = new SipMessage(msg);
+        let responseMsg;
+        try {
+          responseMsg = new SipMessage(msg);
+        } catch(err) {
+          console.error(err, `unable to parse echoed sent response: ${msg}`);
+          if (callback) callback(err);
+          return;
+        }
         res.meta = meta;
         if (callback) {
           callback(null, responseMsg);
@@ -401,7 +415,14 @@ class DrachtioAgent extends Emitter {
         if ('OK' !== token[0]) {
           return callback(token[1]);
         }
-        callback(null, new SipMessage(msg));
+        let sipMsg;
+        try {
+          sipMsg = new SipMessage(msg);
+        } catch(err) {
+          console.error(err, `unable to parse echoed sent ACK: ${msg}`);
+          return callback(err);
+        }
+        callback(null, sipMsg);
       });
     }
   }
@@ -808,7 +829,13 @@ class DrachtioAgent extends Emitter {
         const msgSource = token[2];
         const msgTime = token[3];
         rawMsg = msg.slice(pos + 2);
-        const cdrSipMsg = new SipMessage(rawMsg);
+        let cdrSipMsg;
+        try {
+          cdrSipMsg = new SipMessage(rawMsg);
+        } catch(err) {
+          console.error(err, `unable to parse CDR sip message: ${rawMsg}`);
+          return;
+        }
         const args = [msgSource, msgTime];
         if (cdrEvent !== 'attempt') { args.push(token[4]); }
         args.push(cdrSipMsg);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drachtio-srf",
-  "version": "5.0.21",
+  "version": "5.0.23",
   "description": "drachtio signaling resource framework",
   "main": "lib/srf.js",
   "types": "lib/@types/index.d.ts",

package/test/unit-tests/digest-client.js

@@ -134,3 +134,66 @@ describe('DigestClient proxy pinning after challenge', function() {
   });
 
 });
+
+describe('DigestClient malformed challenge handling', function() {
+
+  function resWithChallenge(value) {
+    const options = {
+      method: 'INVITE',
+      uri: 'sip:u@sbc.example.com',
+      auth: {username: 'u', password: 'p'},
+      headers: {}
+    };
+    const req = {
+      method: 'INVITE',
+      _originalParams: {options},
+      get: () => undefined,
+      getParsedHeader: () => ({seq: 1, method: 'INVITE'})
+    };
+    return {
+      statusCode: 401,
+      source_address: '1.1.1.1',
+      source_port: 5060,
+      socket: {},
+      req,
+      agent: {request: () => {}},
+      has: (h) => h.toLowerCase() === 'www-authenticate',
+      get: (h) => h.toLowerCase() === 'www-authenticate' ? value : undefined
+    };
+  }
+
+  it('returns Error (does not throw) when www-authenticate value is undefined', function(done) {
+    new DigestClient(resWithChallenge(undefined)).authenticate((err) => {
+      err.should.be.an.Error();
+      err.message.should.match(/empty or non-string/);
+      done();
+    });
+  });
+
+  it('returns Error when www-authenticate value is empty string', function(done) {
+    new DigestClient(resWithChallenge('')).authenticate((err) => {
+      err.should.be.an.Error();
+      err.message.should.match(/empty or non-string/);
+      done();
+    });
+  });
+
+  it('_parseChallenge returns {} for undefined input', function() {
+    const out = new DigestClient(resWithChallenge('Digest realm="x",nonce="y"'))
+      ._parseChallenge(undefined);
+    out.should.eql({});
+  });
+
+  it('_parseChallenge returns {} for non-Digest input', function() {
+    const out = new DigestClient(resWithChallenge('Digest realm="x",nonce="y"'))
+      ._parseChallenge('Basic realm="x"');
+    out.should.eql({});
+  });
+
+  it('_parseChallenge captures digit-containing directive names (md5 algorithm)', function() {
+    const out = new DigestClient(resWithChallenge('Digest realm="x",nonce="y"'))
+      ._parseChallenge('Digest realm="x",nonce="y",algorithm=MD5');
+    out.algorithm.should.eql('MD5');
+  });
+
+});