playsocketjs 5.2.0 → 5.3.0

package/README.md

@@ -282,6 +282,7 @@ new PlaySocketServer(options?: PlaySocketServerOptions)
 | `path` | `string` | No | "/" | WebSocket endpoint path. |
 | `server` | `http.Server` | No | - | Existing http server. |
 | `rateLimit` | `number` | No | 20 | Messages/second rate limit. |
+| `maxPayload` | `number` | No | 6291456 | Max. size of a single incoming message in bytes. |
 | `debug` | `boolean` | No | false | Enable debug logging. |
 | `verifyClient` | `function` | No | - | Callback to verify connections before WebSocket upgrade. |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "playsocketjs",
-  "version": "5.2.0",
+  "version": "5.3.0",
   "description": "WebSocket wrapper for creating simple multiplayer systems with ease.",
   "type": "module",
   "module": "./src/client/client.js",

package/src/server/server.js

@@ -88,10 +88,11 @@ export default class PlaySocketServer {
      * @param {string} [options.path='/'] - WebSocket endpoint path
      * @param {boolean} [options.debug=false] - Enable debug logging
      * @param {number} [options.rateLimit=20] - Maximum number of operations per second per client
+     * @param {number} [options.maxPayload=6291456] - Maximum size of a single incoming message in bytes
      * @param {import("ws").ServerOptions["verifyClient"]} [options.verifyClient] - Optional callback to verify client connections before upgrade. Receives (info, callback) where info contains { req, origin } and callback is (verified, code?, message?) => void
      */
     constructor(options = {}) {
-        const { server, port = 3000, path = "/", debug = false, rateLimit = 20, verifyClient } = options;
+        const { server, port = 3000, path = "/", debug = false, rateLimit = 20, maxPayload = 6 * 1024 * 1024, verifyClient } = options;
 
         if (debug) this.#debug = true; // Enable extra logging
 
@@ -112,6 +113,7 @@ export default class PlaySocketServer {
         this.#wss = new WebSocketServer({
             server: this.#server,
             path,
+            maxPayload,
             ...(verifyClient && { verifyClient })
         });
 

package/src/universal/constants.js

@@ -9,7 +9,7 @@ export const HEARTBEAT_INTERVAL = 5000;
 /**
  * Library version, must match package.json
  */
-export const VERSION = "5.2.0";
+export const VERSION = "5.3.0";
 
 /**
  * Logging prefixes

package/src/universal/crdtManager.js

@@ -110,7 +110,7 @@ export default class CRDTManager {
     importPropertyUpdate(update) {
         try {
             const { key, operation: rawOperation, vectorClock } = update;
-            const operation = /** @type {Operation} */ (this.#sanitizeValue(rawOperation));
+            const operation = /** @type {Operation} */ (this.#normalizeAndCopy(rawOperation));
             if (this.#debug) console.log(CONSOLE_PREFIX + "Importing update:", update); // Debug
 
             // Check key limit to safeguard against too many keys
@@ -183,9 +183,9 @@ export default class CRDTManager {
      */
     updateProperty(key, type, value, secondValue) {
         try {
-            // Sanitize inputs
-            value = this.#sanitizeValue(value);
-            secondValue = this.#sanitizeValue(secondValue);
+            // Normalize inputs
+            value = this.#normalizeAndCopy(value);
+            secondValue = this.#normalizeAndCopy(secondValue);
 
             // Debug log
             if (this.#debug) console.log(CONSOLE_PREFIX + `Updating property with key ${key}, type ${type}, value ${value} and secondValue ${secondValue}`);
@@ -431,20 +431,15 @@ export default class CRDTManager {
     }
 
     /**
-     * Remove HTML to prevent XSS and enforce size limits
-     * @param {*} value - Value to sanitize
-     * @returns {*} Sanitized value
+     * Enforce size limit, normalize undefined to null, and return deep copy
+     * @param {*} value - Value to normalize
+     * @returns {*} Normalized value
      */
-    #sanitizeValue(value) {
-        if (value === undefined) return null; // Normalize undefined to null to avoid divergence in transport
-
-        // Check total serialized size
-        const jsonString = JSON.stringify(value);
-        if (jsonString?.length > 50000) throw new Error("Value too large"); // 50KB limit
-
-        if (typeof value === "string") return (value.includes("<") || value.includes(">")) ? value.replace(/[<>]/g, "") : value;
-        if (Array.isArray(value)) return Array.from(value, item => this.#sanitizeValue(item));
-        if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, this.#sanitizeValue(v)]));
+    #normalizeAndCopy(value) {
+        if (value === undefined) return null;
+        if (JSON.stringify(value)?.length > 50_000) throw new Error("Value too large"); // 50KB limit
+        if (Array.isArray(value)) return Array.from(value, item => this.#normalizeAndCopy(item));
+        if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, this.#normalizeAndCopy(v)]));
         return value;
     }
 

package/types/server/server.d.ts

@@ -114,6 +114,7 @@ export default class PlaySocketServer {
      * @param {string} [options.path='/'] - WebSocket endpoint path
      * @param {boolean} [options.debug=false] - Enable debug logging
      * @param {number} [options.rateLimit=20] - Maximum number of operations per second per client
+     * @param {number} [options.maxPayload=6291456] - Maximum size of a single incoming message in bytes
      * @param {import("ws").ServerOptions["verifyClient"]} [options.verifyClient] - Optional callback to verify client connections before upgrade. Receives (info, callback) where info contains { req, origin } and callback is (verified, code?, message?) => void
      */
     constructor(options?: {
@@ -122,6 +123,7 @@ export default class PlaySocketServer {
         path?: string;
         debug?: boolean;
         rateLimit?: number;
+        maxPayload?: number;
         verifyClient?: import("ws").ServerOptions["verifyClient"];
     });
     /**

package/types/universal/constants.d.ts

@@ -8,7 +8,7 @@ export declare const HEARTBEAT_INTERVAL = 5000;
 /**
  * Library version, must match package.json
  */
-export declare const VERSION = "5.2.0";
+export declare const VERSION = "5.3.0";
 /**
  * Logging prefixes
  */