playsocketjs 2.2.0 → 2.2.1

package/README.md

@@ -96,10 +96,10 @@ new PlaySocket(id?: string, options: PlaySocketOptions)
 ### Methods
 
 - `init()`: Initialize the WebSocket connection – Returns Promise (async) which resolves with the client's ID
-- `createRoom(initialStorage?: object, maxSize?: number)`: Create a new room and become host – Returns Promise (async) which resolves with the room ID (matches the creator's ID)
+- `createRoom(initialStorage?: object, maxSize?: number)`: Create a new room and become host – Returns Promise (async) which resolves with the room ID (matches the creator's ID). The absolute client maximum is 100
 - `joinRoom(hostId: string)`: Join an existing room – Returns Promise (async)
 - `destroy()`: Use this to leave a room and close the connection
-- `updateStorage(key: string, type: 'set' | 'array-add' | 'array-add-unique' | 'array-remove-matching' | 'array-update-matching', value: any, updateValue?: any)`: Update the shared storage. Safely update arrays in storage by adding, removing, or updating items. UpdateValue is only required for the 'array-update-matching' operation type
+- `updateStorage(key: string, type: 'set' | 'array-add' | 'array-add-unique' | 'array-remove-matching' | 'array-update-matching', value: any, updateValue?: any)`: Update the shared storage (max. 100 keys). Safely update arrays in storage by adding, removing, or updating items. UpdateValue is only required for the 'array-update-matching' operation type
 - `sendRequest(name: string, data?: any)`: Send requests to the server with optional custom data (handle these in the `requestReceived` server event)
 - `onEvent(event: string, callback: Function)`: Register an event callback
 

package/dist/playsocket-client.js

@@ -1758,9 +1758,11 @@ function requireCrdtManager () {
 	            const operation = this.#sanitizeValue(rawOperation);
 	            if (this.#debug) console.log(CONSOLE_PREFIX + "Importing update:", data); // Debug
 
+	            // Check key limit to afeguard against too many keys
+	            if (this.#keyOperations.size >= 100 && !this.#keyOperations.has(key)) throw new Error('Key limit exceeded!');
+
 	            // Get COPY of current ops (or empty array if none yet)
 	            const currentOps = [...(this.#keyOperations.get(key) || [])];
-
 	            // Merge vector clocks (always take max value)
 	            for (const [id, counter] of vectorClock) {
 	                if (!this.#vectorClock.has(id) || this.#vectorClock.get(id) < counter) {
@@ -1768,7 +1770,7 @@ function requireCrdtManager () {
 	                }
 	            }
 
-	            // Saveguard
+	            // Safeguard against massive vector clocks
 	            if (this.#vectorClock.size > 1000) this.#vectorClock = new Map([...this.#vectorClock].slice(-100));
 
 	            // Add new operation if it's not already added
@@ -2019,11 +2021,15 @@ function requireCrdtManager () {
 	    }
 
 	    /**
-	     * Remove HTML to prevent XSS
-	     * @param {Object} obj 
+	     * Remove HTML to prevent XSS and enforce size limits
+	     * @param {Object} obj
 	     * @returns {Object} - Sanitized object
 	     */
 	    #sanitizeValue(obj) {
+	        // Check total serialized size
+	        const jsonString = JSON.stringify(obj);
+	        if (jsonString?.length > 50000) throw new Error('Value too large!'); // 50KB limit
+
 	        if (typeof obj === 'string') return (obj.includes('<') || obj.includes('>')) ? obj.replace(/[<>]/g, '') : obj;
 	        if (Array.isArray(obj)) return obj.map(item => this.#sanitizeValue(item));
 	        if (obj && typeof obj === 'object') return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, this.#sanitizeValue(v)]));

package/dist/playsocket-server.js

@@ -1884,9 +1884,11 @@ function requireCrdtManager () {
 	            const operation = this.#sanitizeValue(rawOperation);
 	            if (this.#debug) console.log(CONSOLE_PREFIX + "Importing update:", data); // Debug
 
+	            // Check key limit to afeguard against too many keys
+	            if (this.#keyOperations.size >= 100 && !this.#keyOperations.has(key)) throw new Error('Key limit exceeded!');
+
 	            // Get COPY of current ops (or empty array if none yet)
 	            const currentOps = [...(this.#keyOperations.get(key) || [])];
-
 	            // Merge vector clocks (always take max value)
 	            for (const [id, counter] of vectorClock) {
 	                if (!this.#vectorClock.has(id) || this.#vectorClock.get(id) < counter) {
@@ -1894,7 +1896,7 @@ function requireCrdtManager () {
 	                }
 	            }
 
-	            // Saveguard
+	            // Safeguard against massive vector clocks
 	            if (this.#vectorClock.size > 1000) this.#vectorClock = new Map([...this.#vectorClock].slice(-100));
 
 	            // Add new operation if it's not already added
@@ -2145,11 +2147,15 @@ function requireCrdtManager () {
 	    }
 
 	    /**
-	     * Remove HTML to prevent XSS
-	     * @param {Object} obj 
+	     * Remove HTML to prevent XSS and enforce size limits
+	     * @param {Object} obj
 	     * @returns {Object} - Sanitized object
 	     */
 	    #sanitizeValue(obj) {
+	        // Check total serialized size
+	        const jsonString = JSON.stringify(obj);
+	        if (jsonString?.length > 50000) throw new Error('Value too large!'); // 50KB limit
+
 	        if (typeof obj === 'string') return (obj.includes('<') || obj.includes('>')) ? obj.replace(/[<>]/g, '') : obj;
 	        if (Array.isArray(obj)) return obj.map(item => this.#sanitizeValue(item));
 	        if (obj && typeof obj === 'object') return Object.fromEntries(Object.entries(obj).map(([k, v]) => [k, this.#sanitizeValue(v)]));
@@ -2412,7 +2418,7 @@ function requireServer () {
 	                    this.#rooms[newRoomId] = {
 	                        participants: [ws.clientId],
 	                        host: ws.clientId,
-	                        maxSize: data.size || null,
+	                        maxSize: Math.min(Number(data.size), 100) || 100, // Max. limit is 100 clients / room
 	                        crdtManager: roomCrdtManager
 	                    };
 	                    this.#clientRooms.set(ws.clientId, newRoomId); // Add client to the room
@@ -2428,12 +2434,12 @@ function requireServer () {
 	                    const room = this.#rooms[roomId];
 
 	                    if (!room ||
-	                        (room.maxSize && room.participants.length >= room.maxSize) ||
+	                        (room.participants.length >= room.maxSize) ||
 	                        this.#clientRooms.get(ws.clientId)) {
 	                        ws.send(encode({
 	                            type: 'join_rejected',
 	                            reason: !room ? 'Room not found' :
-	                                room.maxSize && room.participants.length >= room.maxSize ? 'Room full' :
+	                                room.participants.length >= room.maxSize ? 'Room full' :
 	                                    'Already in a room'
 	                        }), { binary: true });
 	                        return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "playsocketjs",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "WebSocket wrapper for creating simple multiplayer systems with ease.",
   "module": "dist/playsocket-client.js",
   "exports": {