playsocketjs 1.2.2 → 1.3.1

package/README.md

@@ -199,6 +199,7 @@ Creates a new PlaySocket Server instance with configuration options.
 ### Methods
 
 - `stop`: Closes all active client connections, the websocket server and the underlying http server if it's standalone
+- `kick(clientId: string, reason?: string)`: Kick a client by their clientID – this will close their connection and set an error message
 - `onEvent(event: string, callback: Function)`: Register a server-side event callback
 
 ##### Event types

package/dist/playsocket-client.js

@@ -1754,7 +1754,8 @@ function requireCrdtManager () {
 	     */
 	    importPropertyUpdate(data) {
 	        try {
-	            const { key, operation, vectorClock } = data;
+	            const { key, operation: rawOperation, vectorClock } = data;
+	            const operation = this.#sanitizeValue(rawOperation);
 	            if (this.#debug) console.log(CONSOLE_PREFIX + "Importing update:", data); // Debug
 
 	            // Get COPY of current ops (or empty array if none yet)
@@ -1797,6 +1798,10 @@ function requireCrdtManager () {
 	     */
 	    updateProperty(key, operation, value, updateValue) {
 	        try {
+	            // Sanitize inputs
+	            value = this.#sanitizeValue(value);
+	            updateValue = this.#sanitizeValue(updateValue);
+
 	            // Debug log
 	            if (this.#debug) console.log(CONSOLE_PREFIX + `Updating property with key ${key}, operation ${operation}, value ${value} and updateValue ${updateValue}.`);
 
@@ -1923,7 +1928,11 @@ function requireCrdtManager () {
 	        }
 	    }
 
-	    // Sort by vector clock (causal order)
+	    /**
+	     * Sort by vector clock (causal order)
+	     * @param {Array} operations
+	     * @returns {Array} - Sorted operations
+	     */
 	    #sortByVectorClock(operations) {
 	        return [...operations].sort((a, b) => {
 	            const clockA = new Map(a.vectorClock || []);
@@ -1955,7 +1964,14 @@ function requireCrdtManager () {
 	        });
 	    }
 
-	    // Handle an operation
+	    /**
+	     * Handle an operation
+	     * @param {*} curValue 
+	     * @param {string} operation 
+	     * @param {*} value 
+	     * @param {*} [updateValue]
+	     * @returns {*} - Value after the operation
+	     */
 	    #handleOperation(curValue, operation, value, updateValue) {
 	        try {
 	            // Clone to avoid reference issues
@@ -2002,6 +2018,18 @@ function requireCrdtManager () {
 	        }
 	    }
 
+	    /**
+	     * Remove HTML to prevent XSS
+	     * @param {Object} obj 
+	     * @returns {Object} - Sanitized object
+	     */
+	    #sanitizeValue(obj) {
+	        if (typeof obj === 'string') return (obj.includes('<') || obj.includes('>')) ? obj.replace(/[<>]/g, '') : obj;
+	        if (Array.isArray(obj)) return obj.map(item => this.#sanitizeValue(item));
+	        if (obj && typeof obj === 'object') return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, this.#sanitizeValue(v)]));
+	        return obj;
+	    }
+
 	    // Get property store
 	    get getPropertyStore() {
 	        try {
@@ -2295,6 +2323,11 @@ class PlaySocket {
                         this.destroy();
                         break;
 
+                    case 'kicked':
+                        this.#triggerEvent("error", `Kicked out of room: ${message.reason || "No reason provided."}`);
+                        this.destroy();
+                        break;
+
                     case 'host_migrated':
                         this.#setHost(message.newHost);
                         break;

package/dist/playsocket-server.js

@@ -1880,7 +1880,8 @@ function requireCrdtManager () {
 	     */
 	    importPropertyUpdate(data) {
 	        try {
-	            const { key, operation, vectorClock } = data;
+	            const { key, operation: rawOperation, vectorClock } = data;
+	            const operation = this.#sanitizeValue(rawOperation);
 	            if (this.#debug) console.log(CONSOLE_PREFIX + "Importing update:", data); // Debug
 
 	            // Get COPY of current ops (or empty array if none yet)
@@ -1923,6 +1924,10 @@ function requireCrdtManager () {
 	     */
 	    updateProperty(key, operation, value, updateValue) {
 	        try {
+	            // Sanitize inputs
+	            value = this.#sanitizeValue(value);
+	            updateValue = this.#sanitizeValue(updateValue);
+
 	            // Debug log
 	            if (this.#debug) console.log(CONSOLE_PREFIX + `Updating property with key ${key}, operation ${operation}, value ${value} and updateValue ${updateValue}.`);
 
@@ -2049,7 +2054,11 @@ function requireCrdtManager () {
 	        }
 	    }
 
-	    // Sort by vector clock (causal order)
+	    /**
+	     * Sort by vector clock (causal order)
+	     * @param {Array} operations
+	     * @returns {Array} - Sorted operations
+	     */
 	    #sortByVectorClock(operations) {
 	        return [...operations].sort((a, b) => {
 	            const clockA = new Map(a.vectorClock || []);
@@ -2081,7 +2090,14 @@ function requireCrdtManager () {
 	        });
 	    }
 
-	    // Handle an operation
+	    /**
+	     * Handle an operation
+	     * @param {*} curValue 
+	     * @param {string} operation 
+	     * @param {*} value 
+	     * @param {*} [updateValue]
+	     * @returns {*} - Value after the operation
+	     */
 	    #handleOperation(curValue, operation, value, updateValue) {
 	        try {
 	            // Clone to avoid reference issues
@@ -2128,6 +2144,18 @@ function requireCrdtManager () {
 	        }
 	    }
 
+	    /**
+	     * Remove HTML to prevent XSS
+	     * @param {Object} obj 
+	     * @returns {Object} - Sanitized object
+	     */
+	    #sanitizeValue(obj) {
+	        if (typeof obj === 'string') return (obj.includes('<') || obj.includes('>')) ? obj.replace(/[<>]/g, '') : obj;
+	        if (Array.isArray(obj)) return obj.map(item => this.#sanitizeValue(item));
+	        if (obj && typeof obj === 'object') return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, this.#sanitizeValue(v)]));
+	        return obj;
+	    }
+
 	    // Get property store
 	    get getPropertyStore() {
 	        try {
@@ -2279,7 +2307,7 @@ function requireServer () {
 
 	                    // Generate client ID if none provided
 	                    if (!data.id) {
-	                        const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+	                        const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ123456789';
 	                        const maxAttempts = 50;
 	                        for (let i = 0; i < maxAttempts; i++) {
 	                            const id = Array.from({ length: 6 }, () => chars[Math.floor(Math.random() * chars.length)]).join('');
@@ -2587,6 +2615,20 @@ function requireServer () {
 	        this.#callbacks.get(event).push(callback);
 	    }
 
+	    /**
+	     * Kick a player from the server
+	     * @param {string} clientId - Client ID
+	     * @param {string} [reason] - Optional reason
+	     */
+	    kick(clientId, reason) {
+	        const client = this.#clients.get(clientId);
+	        if (client) {
+	            client.willfulDisconnect = true;
+	            client.send(encode({ type: 'kicked', reason }), { binary: true });
+	            client.close();
+	        }
+	    }
+
 	    /**
 	     * Trigger an event to registered callbacks
 	     * @private
@@ -2604,7 +2646,7 @@ function requireServer () {
 	    stop() {
 	        clearInterval(this.#heartbeatInterval);
 	        if (this.#wss) {
-	            this.#wss.clients.forEach(client => {
+	            this.#clients.forEach(client => {
 	                client.send(encode({ type: 'server_stopped' }), { binary: true });
 	                client.close();
 	            });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "playsocketjs",
-  "version": "1.2.2",
+  "version": "1.3.1",
   "description": "WebSocket wrapper for creating simple multiplayer systems with ease.",
   "module": "dist/playsocket-client.js",
   "exports": {