sync-rpc 1.3.6 → 1.3.7

package/lib/index.js

@@ -3,6 +3,7 @@
 const path = require('path');
 const spawn = require('child_process').spawn;
 const spawnSync = require('child_process').spawnSync;
+const crypto = require('crypto');
 const JSON = require('./json-buffer');
 
 const host = '127.0.0.1';
@@ -21,6 +22,7 @@ function nodeNetCatSrc(port, input) {
 const FUNCTION_PRIORITY = [nativeNC, nodeNC];
 
 let started = false;
+let key;
 const configuration = {port: null, fastestFunction: null};
 function start() {
   if (!spawnSync) {
@@ -29,8 +31,9 @@ function start() {
         'you can `npm install sync-request@2.2.0`, which was the last version to support older versions of node.'
     );
   }
+  key = crypto.randomBytes(32).toString('hex');
   const port = findPort();
-  const p = spawn(process.execPath, [require.resolve('./worker'), port], {
+  const p = spawn(process.execPath, [require.resolve('./worker'), port, key], {
     stdio: 'inherit',
     windowsHide: true,
   });
@@ -131,6 +134,7 @@ function getFastestFunction(port) {
 
 function sendMessage(input) {
   if (!started) start();
+  input.k = key;
   const res = configuration.fastestFunction(
     configuration.port,
     JSON.stringify(input) + '\r\n'
@@ -171,7 +175,7 @@ function extractValue(msg) {
 
 function createClient(filename, args) {
   const id = extractValue(sendMessage({t: 1, f: filename, a: args}));
-  return function(args) {
+  return function (args) {
     return extractValue(sendMessage({t: 0, i: id, a: args}));
   };
 }

package/lib/worker.js

@@ -1,14 +1,17 @@
 'use strict';
 
+const crypto = require('crypto');
 const net = require('net');
 const JSON = require('./json-buffer');
 
+const key = Buffer.from(process.argv[3], 'utf8');
+
 const INIT = 1;
 const CALL = 0;
 const modules = [];
 
 const NULL_PROMISE = Promise.resolve(null);
-const server = net.createServer({allowHalfOpen: true}, c => {
+const server = net.createServer({allowHalfOpen: true}, (c) => {
   let responded = false;
   function respond(data) {
     if (responded) return;
@@ -17,10 +20,10 @@ const server = net.createServer({allowHalfOpen: true}, c => {
   }
 
   let buffer = '';
-  c.on('error', function(err) {
+  c.on('error', function (err) {
     respond({s: false, v: {code: err.code, message: err.message}});
   });
-  c.on('data', function(data) {
+  c.on('data', function (data) {
     buffer += data.toString('utf8');
     if (/\r\n/.test(buffer)) {
       onMessage(buffer.trim());
@@ -31,17 +34,21 @@ const server = net.createServer({allowHalfOpen: true}, c => {
       c.end('pong');
       return;
     }
-    NULL_PROMISE.then(function() {
+    NULL_PROMISE.then(function () {
       const req = JSON.parse(str);
+      const k = Buffer.from(req.k, 'utf8');
+      if (k.byteLength !== key.byteLength || !crypto.timingSafeEqual(k, key)) {
+        throw new Error('Invalid key');
+      }
       if (req.t === INIT) {
         return init(req.f, req.a);
       }
       return modules[req.i](req.a);
     }).then(
-      function(response) {
+      function (response) {
         respond({s: true, v: response});
       },
-      function(err) {
+      function (err) {
         respond({s: false, v: {code: err.code, message: err.message}});
       }
     );
@@ -56,13 +63,13 @@ function init(filename, arg) {
   if (typeof m !== 'function') {
     throw new Error(filename + ' did not export a function.');
   }
-  return NULL_PROMISE.then(function() {
+  return NULL_PROMISE.then(function () {
     return m(arg);
-  }).then(function(fn) {
+  }).then(function (fn) {
     const i = modules.length;
     modules[i] = fn;
     return i;
   });
 }
 
-server.listen(+process.argv[2]);
+server.listen(+process.argv[2], '127.0.0.1');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sync-rpc",
-  "version": "1.3.6",
+  "version": "1.3.7",
   "main": "lib/index.js",
   "description": "Run asynchronous commands synchronously by putting them in a separate process",
   "keywords": [],

package/HISTORY.md

@@ -1,5 +0,0 @@
-# Changelog
-
-## v0.0.1: 2017-xx-xx
-
-- Initial release