whalibmob 5.14.8 → 5.14.11

package/lib/Client.js

@@ -442,9 +442,11 @@ class WhalibmobClient extends EventEmitter {
   async init(phoneNumber) {
     phoneNumber = String(phoneNumber).replace(/\D/g, '');
     this._phoneNumber = phoneNumber;
-    // A fresh attempt clears whatever made the last one fatal. Only the public
-    // entry points reset it — the reconnect loop must not clear its own guard.
-    this._fatal = false;
+    // A fresh attempt clears whatever made the last one fatal, and whatever
+    // deliberate disconnect came before it. Only the public entry points reset
+    // these — the reconnect loop must not clear its own guards.
+    this._fatal   = false;
+    this._closing = false;
 
     this._sessionDir = sessionDirFor(this._baseDir, phoneNumber);
 
@@ -621,7 +623,9 @@ class WhalibmobClient extends EventEmitter {
     phoneNumber = String(phoneNumber).replace(/\D/g, '');
     this._phoneNumber = phoneNumber;
     this._mode = 'web';
-    this._fatal = false;
+    // Same as init(): a fresh attempt lifts both guards from the last one.
+    this._fatal   = false;
+    this._closing = false;
 
     const { createNewWebStore, loadWebStore, saveWebStore, webSessionPath } =
       require('./WebStore');
@@ -1066,13 +1070,34 @@ class WhalibmobClient extends EventEmitter {
     return idx > 0 ? `${lidUser}:${idx}@lid` : `${lidUser}@lid`;
   }
 
-  disconnect() {
+  /**
+   * Close the connection, and keep it closed.
+   *
+   * Connect again through init() / initWeb() — those are where the caller says
+   * it wants a connection, and where the guard below is lifted.
+   *
+   * @param {object}  [opts]
+   * @param {boolean} [opts.reconnect=false]  drop the current socket but leave
+   *        the reconnect loop armed. For a failure the server has told us is
+   *        temporary, where coming back is the right answer.
+   */
+  disconnect(opts) {
     // Closing the socket makes it emit 'close', which lands in _onClose and
     // schedules a reconnect. That is right for a dropped connection and wrong
     // for a deliberate teardown — and it is what turned a single <failure> into
     // an endless retry loop, since clearing _reconnecting was not enough to
     // stop the handler that sets it again.
-    this._closing      = true;
+    //
+    // For that to work the guard has to still be set when the 'close' arrives,
+    // and it arrives on a later tick — a socket is destroyed now and reports it
+    // afterwards. Clearing it at the end of this method, which is what it used
+    // to do, meant _scheduleReconnect() never once saw it set: every deliberate
+    // disconnect dialled straight back in a second later, and /reconnect ended
+    // up with the old session live alongside the new one.
+    //
+    // Only ever set here, never cleared, so a teardown that means it cannot be
+    // undone by a later one that does not.
+    if (!(opts && opts.reconnect)) this._closing = true;
     this._reconnecting = false;
     this._reconnectTry = 0;
     this._stopTimers();
@@ -1082,7 +1107,6 @@ class WhalibmobClient extends EventEmitter {
     }
     this._connected = false;
     this.emit('close');
-    this._closing = false;
   }
 
   /**
@@ -3280,7 +3304,11 @@ class WhalibmobClient extends EventEmitter {
     this.emit('auth_failure', { reason, location: loc, loggedOut: spent, node });
     this._fatal = spent;
     this._reconnecting = false;
-    this.disconnect();
+    // A reason that did not kill the session is one to come back from, so this
+    // teardown leaves the reconnect loop armed — a 503 is the server having a
+    // bad minute, not a reason to abandon a working registration. A reason that
+    // did kill it is fatal, and _scheduleReconnect() stands down on that itself.
+    this.disconnect({ reconnect: !spent });
   }
 
   // ─── Media connection ─────────────────────────────────────────────────────

package/lib/Registration.js

@@ -482,7 +482,7 @@ const COUNTRY_META = {
   '370':   { mcc: '246', mnc: '01', lg: 'lt', lc: 'LT' }, // Lithuania (Telia)
   '371':   { mcc: '247', mnc: '01', lg: 'lv', lc: 'LV' }, // Latvia (LMT)
   '372':   { mcc: '248', mnc: '01', lg: 'et', lc: 'EE' }, // Estonia (Telia)
-  '373':   { mcc: '255', mnc: '00', lg: 'ro', lc: 'MD' }, // Moldova (IDC)
+  '373':   { mcc: '259', mnc: '01', lg: 'ro', lc: 'MD' }, // Moldova (Orange)
   '374':   { mcc: '283', mnc: '01', lg: 'hy', lc: 'AM' }, // Armenia (Beeline)
   '375':   { mcc: '257', mnc: '01', lg: 'be', lc: 'BY' }, // Belarus (A1)
   '376':   { mcc: '213', mnc: '03', lg: 'ca', lc: 'AD' }, // Andorra (Som, Mobiland)
@@ -499,7 +499,7 @@ const COUNTRY_META = {
   '423':   { mcc: '295', mnc: '01', lg: 'de', lc: 'LI' }, // Liechtenstein (Swisscom)
   '500':   { mcc: '750', mnc: '001', lg: 'en', lc: 'FK' }, // Falkland Islands (Sure)
   '501':   { mcc: '702', mnc: '67', lg: 'en', lc: 'BZ' }, // Belize (DigiCell)
-  '502':   { mcc: '704', mnc: '?', lg: 'es', lc: 'GT' }, // Guatemala (RED/INTELFON)
+  '502':   { mcc: '704', mnc: '01', lg: 'es', lc: 'GT' }, // Guatemala (Claro)
   '503':   { mcc: '706', mnc: '01', lg: 'es', lc: 'SV' }, // El Salvador (Claro)
   '504':   { mcc: '708', mnc: '001', lg: 'es', lc: 'HN' }, // Honduras (Claro)
   '505':   { mcc: '710', mnc: '21', lg: 'es', lc: 'NI' }, // Nicaragua (Claro)

package/lib/image/Bmp.js

@@ -13,15 +13,27 @@ function isBmp(buf) {
 // One channel out of a packed pixel. A mask says where the channel sits and how
 // wide it is, and the width varies — 5-6-5 and 5-5-5 are both ordinary — so the
 // value is scaled by its own maximum rather than shifted by a fixed amount.
+//
+// Both scans below stop at 32 on their own, because a shift count in JS is
+// taken mod 32: `bits >>> 32` is `bits >>> 0`, so a mask of all ones sends an
+// unbounded scan back to bit 0 and it never comes out. Nothing upstream could
+// catch that — decodeImage's try/catch cannot interrupt a loop that does not
+// end, and a thumbnail is built on the way to sending an ordinary image, so
+// one crafted BMP would take the whole process down with it.
 function maskChannel(v, mask) {
   if (!mask) return 0;
   let shift = 0;
-  while (!((mask >>> shift) & 1)) shift++;
+  while (shift < 32 && !((mask >>> shift) & 1)) shift++;
+  if (shift === 32) return 0;                    // no bit set — nothing to read
   const bits = (mask >>> shift) >>> 0;
   let width = 0;
-  while ((bits >>> width) & 1) width++;
-  const max = (1 << width) - 1;
-  return Math.round(((v >>> shift) & max) * 255 / max);
+  while (width < 32 && ((bits >>> width) & 1)) width++;
+  // The obvious `(1 << width) - 1` is wrong at both ends of that range: `1 <<
+  // 32` is 1, and `1 << 31` is negative, so a 31- or 32-bit channel would be
+  // scaled by zero or by a negative maximum. Build the maximum unsigned, and
+  // read the value back unsigned too — `& 0xffffffff` alone yields an int32.
+  const max = width >= 32 ? 0xffffffff : ((1 << width) >>> 0) - 1;
+  return Math.round((((v >>> shift) & max) >>> 0) * 255 / max);
 }
 
 function decodeBmp(buf) {

package/lib/signal/SignalStore.js

@@ -14,6 +14,27 @@ const { SessionRecord } = require('./libsignal');
 //   • on process exit, flush synchronously (so state is never lost)
 //
 // Result: zero blocking disk I/O during the encryption hot-path.
+//
+// Two rules keep that from costing the account everything it knows:
+//
+//   • Every write goes to a temp file and is renamed into place. Writing over
+//     the live path is not one step — it is an open, a truncate and as many
+//     writes as the file needs — and anything that reads or writes in the
+//     middle of that sees a mixture of two snapshots. That mixture is not
+//     valid JSON, and _load() below answers unreadable state with an empty
+//     store, so a single interleaved write silently costs the account every
+//     session, pre-key, identity and LID mapping it had. rename(2) is atomic:
+//     the file is one whole snapshot or the other, never a blend.
+//
+//   • A write never lands if newer state reached the disk while it was in
+//     flight. The async write started by the debounce is not cancellable, and
+//     a synchronous flush — detach(), or the exit handlers — can easily
+//     overtake it; letting the older snapshot finish last would undo every
+//     session written since. _writtenRev records what the file holds, and a
+//     write that has been overtaken drops its temp file instead of renaming.
+//
+// In-memory state is always the newest thing there is, so any write we abandon
+// costs nothing: the next one writes what is current.
 
 const DEBOUNCE_MS = 300;
 
@@ -37,6 +58,15 @@ class SignalStore {
     this._dirty            = false;
     this._rev              = 0;
     this._saveTimer        = null;
+    // The revision the file on disk actually holds.  An async write compares
+    // against it before renaming: if a synchronous flush got there first, the
+    // write it is holding is stale and must not land.
+    this._writtenRev       = 0;
+    // One async write at a time.  Two of them running together on one path
+    // interleave, and _writeAgain remembers that another one came due while
+    // the first was still going so it can be re-run from a fresh snapshot.
+    this._writing          = false;
+    this._writeAgain       = false;
 
     // Flush synchronously on exit so no state is ever lost.
     //
@@ -61,7 +91,14 @@ class SignalStore {
       process.removeListener('SIGTERM', this._onSigTerm);
       process.removeListener('SIGINT',  this._onSigInt);
     } catch (_) {}
-    this._filePath = null;
+    // Clearing the path is also what tells a write that is still in flight to
+    // stand down — it checks the path it started with before renaming. The
+    // caller detaches in order to move these files, so leave nothing of ours
+    // behind in the directory it is about to rename.
+    const stale = this._filePath ? [this._tmpPath(true), this._tmpPath(false)] : [];
+    this._filePath   = null;
+    this._writeAgain = false;
+    for (const f of stale) { try { fs.unlinkSync(f); } catch (_) {} }
   }
 
   init(identityKeyPair, registrationId) {
@@ -100,23 +137,67 @@ class SignalStore {
     return this._lidMappings;
   }
 
-  // Immediate synchronous flush (used on process exit only)
+  // Everything that is persisted, as it goes on disk.
+  _snapshot() {
+    return JSON.stringify({
+      sessions:      this._sessions,
+      preKeys:       this._preKeys,
+      signedPreKeys: this._signedPreKeys,
+      identities:    this._identities,
+      lidMappings:   this._lidMappings
+    });
+  }
+
+  // Where a write assembles the file before it becomes the file. The sync and
+  // async writers get separate names so the one can never find the other's
+  // half-written temp file under it.
+  _tmpPath(sync) {
+    return this._filePath + (sync ? '.stmp' : '.atmp');
+  }
+
+  // A rename replaces the file, so the one that lands carries the temp file's
+  // permissions and not the old file's. This holds Signal private keys, and an
+  // operator who tightened its mode would find it loosened again by the next
+  // write — so carry whatever the file already had across. null when there is
+  // no file yet, which leaves the default the old writes produced.
+  _modeOf(file) {
+    try { return fs.statSync(file).mode & 0o777; } catch (_) { return null; }
+  }
+
+  // Immediate synchronous flush (process exit, and detach())
   _flushSync() {
     if (!this._dirty || !this._filePath) return;
     if (this._saveTimer) { clearTimeout(this._saveTimer); this._saveTimer = null; }
+    const rev  = this._rev;
+    const file = this._filePath;
+    const tmp  = this._tmpPath(true);
     try {
-      const data = JSON.stringify({
-        sessions:      this._sessions,
-        preKeys:       this._preKeys,
-        signedPreKeys: this._signedPreKeys,
-        identities:    this._identities,
-        lidMappings:   this._lidMappings
-      });
-      const dir = path.dirname(this._filePath);
+      const dir  = path.dirname(file);
       if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-      fs.writeFileSync(this._filePath, data, 'utf8');
-      this._dirty = false;
-    } catch (_) {}
+      const mode = this._modeOf(file);
+      fs.writeFileSync(tmp, this._snapshot(), mode !== null
+        ? { encoding: 'utf8', mode } : 'utf8');
+      if (mode !== null) fs.chmodSync(tmp, mode);
+      fs.renameSync(tmp, file);
+      // Take the async writer's temp file away from it.
+      //
+      // Its "have I been overtaken?" check runs on this thread, but the rename
+      // it authorises is carried out on a pool thread afterwards — and at exit
+      // the pool is usually busy, so that rename can still be queued now and
+      // execute during teardown, putting this snapshot back to an older one.
+      // Its callback never runs there, so nothing would notice or repair it.
+      // Removing the source makes that queued rename fail ENOENT instead.
+      // detach() does the same thing, which is why detach() was never exposed
+      // to this; the exit path simply was not doing it.
+      try { fs.unlinkSync(this._tmpPath(false)); } catch (_) {}
+      // Nothing ran between the snapshot and the rename — this is synchronous —
+      // so the file now holds exactly this revision and there is nothing left
+      // to write.
+      this._writtenRev = rev;
+      this._dirty      = false;
+    } catch (_) {
+      try { fs.unlinkSync(tmp); } catch (_) {}
+    }
   }
 
   // Schedule an async (non-blocking) write after DEBOUNCE_MS inactivity.
@@ -128,25 +209,67 @@ class SignalStore {
     if (this._saveTimer) clearTimeout(this._saveTimer);
     this._saveTimer = setTimeout(() => {
       this._saveTimer = null;
-      // The revision this write is a snapshot of.
-      const rev  = this._rev;
-      const data = JSON.stringify({
-        sessions:      this._sessions,
-        preKeys:       this._preKeys,
-        signedPreKeys: this._signedPreKeys,
-        identities:    this._identities,
-        lidMappings:   this._lidMappings
-      });
-      const dir = path.dirname(this._filePath);
+      this._writeAsync();
+    }, DEBOUNCE_MS);
+  }
+
+  // The debounced write itself: temp file, then rename into place, and only if
+  // nothing newer reached the disk in the meantime.
+  _writeAsync() {
+    if (!this._filePath || !this._dirty) return;
+    // Fold a write that comes due mid-write into the one already running
+    // rather than starting a second one over the same temp file.
+    if (this._writing) { this._writeAgain = true; return; }
+
+    // The revision this write is a snapshot of, and the path it is for. Both
+    // are read once, here: by the time the callbacks run either may have moved
+    // on, and that is exactly what they have to notice.
+    const rev  = this._rev;
+    const file = this._filePath;
+    const tmp  = this._tmpPath(false);
+
+    let data, mode;
+    try {
+      const dir = path.dirname(file);
       if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-      // Only clear the flag when nothing changed while the write was running.
-      // A mutation that arrived after the snapshot is not in `data`, and its
-      // own debounce timer may never fire — clearing here would make the
-      // exit-time _flushSync() skip it and lose it.
-      fs.writeFile(this._filePath, data, 'utf8', () => {
+      mode = this._modeOf(file);
+      data = this._snapshot();
+    } catch (_) { return; }
+
+    this._writing    = true;
+    this._writeAgain = false;
+
+    const finish = () => {
+      this._writing = false;
+      // A write came due while this one was running and was folded into it.
+      // Every other mutation armed its own debounce timer, which is still
+      // pending and will write what is current.
+      if (this._writeAgain && this._dirty && this._filePath) this._writeAsync();
+    };
+    const abandon = () => { fs.unlink(tmp, () => {}); finish(); };
+
+    // Create the temp file already tight rather than widening the window in
+    // which a store full of private keys sits at the umask default.
+    fs.writeFile(tmp, data, mode !== null ? { encoding: 'utf8', mode } : 'utf8', (err) => {
+      if (err) return abandon();
+      // detach() let the file go, or a synchronous flush wrote newer state
+      // while this one was running. Renaming now would put an older snapshot
+      // back and take every session written since with it.
+      if (file !== this._filePath || rev <= this._writtenRev) return abandon();
+      if (mode !== null) { try { fs.chmodSync(tmp, mode); } catch (_) {} }
+      fs.rename(tmp, file, (renameErr) => {
+        if (renameErr) return abandon();
+        // Never walk it backwards: a synchronous flush can land — and record a
+        // higher revision — between the check above and this callback.
+        if (rev > this._writtenRev) this._writtenRev = rev;
+        // Only clear the flag when nothing changed while the write was
+        // running. A mutation that arrived after the snapshot is not in
+        // `data`, and clearing here would make the exit-time _flushSync()
+        // skip it and lose it.
         if (this._rev === rev) this._dirty = false;
+        finish();
       });
-    }, DEBOUNCE_MS);
+    });
   }
 
   // ─── Identity / registration ─────────────────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.14.8",
+  "version": "5.14.11",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API and web ",
   "author": "Kunboruto20",
   "main": "index.js",