whalibmob 5.11.0 → 5.11.1

package/lib/Registration.js

@@ -136,51 +136,144 @@ async function httpPostViaSocks(path, body, waVersion, proxyUrl, authHeader) {
     `Content-Length: ${Buffer.byteLength(body)}`
   ];
   if (authHeader) reqLines.push(`Authorization: ${authHeader}`);
-  // close, not keep-alive: the response is read by waiting for the server to
-  // end the stream. Asking it to keep the connection open means that never
-  // happens and the request hangs until something else times out.
+  // Asked for, but not relied on: the server answers and then keeps the
+  // connection open anyway. The response is finished by its own length, not by
+  // the socket closing.
   reqLines.push(`Connection: close`, '', body);
   const req = reqLines.join('\r\n');
 
   tlsSocket.write(req);
 
-  const chunks = [];
-  await new Promise((res, rej) => {
+  const { status, body: bodyBuf } = await readHttpResponse(tlsSocket, path);
+  const bodyStr = bodyBuf.toString('utf8');
+
+  if (status !== 200) throw new Error(`HTTP ${status} ${path}: ${bodyStr}`);
+  try { return JSON.parse(bodyStr); } catch (_) { return { raw: bodyStr }; }
+}
+
+// A response is over when its own length says so, not when the socket shuts.
+//
+// This is the part `https.request` does for you and a hand-rolled socket does
+// not. WhatsApp answers a registration request in well under a second and then
+// leaves the connection open — `Connection: close` in the request does not
+// change that. Waiting for end or close therefore waited for something that
+// never came, and every proxied registration died on the read timeout with the
+// reply already sitting in the buffer.
+//
+// So: parse as the bytes arrive, and stop at the end of the body — the byte
+// count in Content-Length, or the terminating zero-length chunk. end and close
+// stay as a fallback, for a reply that declares neither and can only be
+// delimited by the connection itself.
+const MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+
+function readHttpResponse(socket, label, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    let raw    = Buffer.alloc(0);
+    let done   = false;
+
     const timer = setTimeout(() => {
-      tlsSocket.destroy();
-      rej(new Error('SOCKS proxy timed out reading ' + path));
-    }, 30000);
-    const finish = (fn, arg) => { clearTimeout(timer); fn(arg); };
-    tlsSocket.on('data',  d  => chunks.push(d));
-    tlsSocket.on('end',   () => finish(res));
-    tlsSocket.on('close', () => finish(res));
-    tlsSocket.on('error', e  => finish(rej, e));
+      settle(reject, new Error('SOCKS proxy timed out reading ' + label));
+    }, timeoutMs || 30000);
+
+    function settle(fn, arg) {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      socket.removeListener('data',  onData);
+      socket.removeListener('end',   onEnd);
+      socket.removeListener('close', onEnd);
+      socket.removeListener('error', onError);
+      socket.destroy();
+      fn(arg);
+    }
+
+    function onData(chunk) {
+      raw = raw.length ? Buffer.concat([raw, chunk]) : chunk;
+      if (raw.length > MAX_RESPONSE_BYTES) {
+        return settle(reject, new Error('response too large reading ' + label));
+      }
+      const parsed = parseHttpResponse(raw, false);
+      if (parsed) settle(resolve, parsed);
+    }
+
+    // The connection did close after all — then whatever arrived is the whole
+    // reply, even without a declared length.
+    function onEnd() {
+      const parsed = parseHttpResponse(raw, true);
+      if (parsed) return settle(resolve, parsed);
+      settle(reject, new Error('connection closed mid-response reading ' + label));
+    }
+
+    function onError(err) { settle(reject, err); }
+
+    socket.on('data',  onData);
+    socket.on('end',   onEnd);
+    socket.on('close', onEnd);
+    socket.on('error', onError);
   });
+}
+
+/**
+ * Parse what has arrived so far.
+ *
+ * Returns { status, headers, body } once the response is complete, or null
+ * while it is still short. With `atEof` the caller is telling us no more bytes
+ * are coming, which is itself a valid way for a body to end.
+ */
+function parseHttpResponse(raw, atEof) {
+  const headerEnd = raw.indexOf('\r\n\r\n');
+  if (headerEnd < 0) return null;
+
+  // Headers are latin1 by definition; only the body may be UTF-8.
+  const headers   = raw.slice(0, headerEnd).toString('latin1');
+  const status    = parseInt(headers.split(' ')[1], 10);
+  const bodyStart = headerEnd + 4;
+
+  if (/^transfer-encoding:[ \t]*chunked/im.test(headers)) {
+    const decoded = decodeChunkedBody(raw.slice(bodyStart));
+    if (decoded) return { status, headers, body: decoded };
+    return atEof ? { status, headers, body: Buffer.alloc(0) } : null;
+  }
 
-  const raw        = Buffer.concat(chunks);
-  const rawStr     = raw.toString('utf8');
-  const headerEnd  = rawStr.indexOf('\r\n\r\n');
-  const headerPart = rawStr.slice(0, headerEnd);
-  const httpStatus = parseInt(rawStr.split(' ')[1]);
-  let bodyStr      = rawStr.slice(headerEnd + 4);
-
-  // Handle chunked transfer encoding
-  if (/transfer-encoding:\s*chunked/i.test(headerPart)) {
-    let decoded = '';
-    let pos = 0;
-    while (pos < bodyStr.length) {
-      const lineEnd = bodyStr.indexOf('\r\n', pos);
-      if (lineEnd === -1) break;
-      const chunkSize = parseInt(bodyStr.slice(pos, lineEnd), 16);
-      if (!chunkSize) break;
-      decoded += bodyStr.slice(lineEnd + 2, lineEnd + 2 + chunkSize);
-      pos = lineEnd + 2 + chunkSize + 2;
+  const match = /^content-length:[ \t]*(\d+)/im.exec(headers);
+  if (match) {
+    const length = parseInt(match[1], 10);
+    // Counted in bytes, which is why this works on the buffer and not on a
+    // decoded string — one accented character in an error message is two bytes
+    // and would leave the check one short forever.
+    if (raw.length - bodyStart >= length) {
+      return { status, headers, body: raw.slice(bodyStart, bodyStart + length) };
     }
-    bodyStr = decoded;
+    return atEof ? { status, headers, body: raw.slice(bodyStart) } : null;
   }
 
-  if (httpStatus !== 200) throw new Error(`HTTP ${httpStatus} ${path}: ${bodyStr}`);
-  try { return JSON.parse(bodyStr); } catch (_) { return { raw: bodyStr }; }
+  // These two carry no body at all, whatever else the headers say.
+  if (status === 204 || status === 304) {
+    return { status, headers, body: Buffer.alloc(0) };
+  }
+
+  // No length anywhere: the body runs to the end of the connection.
+  return atEof ? { status, headers, body: raw.slice(bodyStart) } : null;
+}
+
+/** Decode a chunked body, or null while the terminating chunk is still missing. */
+function decodeChunkedBody(buf) {
+  const parts = [];
+  let pos = 0;
+
+  for (;;) {
+    const lineEnd = buf.indexOf('\r\n', pos);
+    if (lineEnd < 0) return null;
+    // A size line may carry extensions after a semicolon; parseInt stops there.
+    const size = parseInt(buf.slice(pos, lineEnd).toString('latin1'), 16);
+    if (!Number.isFinite(size) || size < 0) return null;
+    if (size === 0) return Buffer.concat(parts);      // the terminating chunk
+    const start = lineEnd + 2;
+    const end   = start + size;
+    if (buf.length < end + 2) return null;            // chunk still arriving
+    parts.push(buf.slice(start, end));
+    pos = end + 2;
+  }
 }
 const {
   REGISTRATION_ENDPOINT,
@@ -953,3 +1046,6 @@ async function verifyCode(store, code) {
 }
 
 module.exports = { checkIfRegistered, checkNumberStatus, requestSmsCode, verifyCode, fetchIosVersion, fetchAndroidVersion, fetchWaVersion, parsePhone, getCountryMeta, assertRegistrationKeys, parseSocksProxy, socksProxyUrl };
+
+// The HTTP reader, exposed for tests. Not part of the public API.
+module.exports._http = { readHttpResponse, parseHttpResponse, decodeChunkedBody };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.11.0",
+  "version": "5.11.1",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto20",
   "main": "index.js",