Giter VIP home page Giter VIP logo

Comments (4)

renatovico avatar renatovico commented on May 7, 2024

i'm changed

the function:

    try {
        var k1 = this.request.headers['sec-websocket-key1'],
                k2 = this.request.headers['sec-websocket-key2'];

        if (k1 && k2) {
            var md5 = crypto.createHash('md5');

            [k1, k2].forEach(function(k) {
                var n = parseInt(k.replace(/[^\d]/g, '')),
                        spaces = k.replace(/[^ ]/g, '').length;

                if (spaces === 0 || n % spaces !== 0) {
                    this.listener.options.log('Invalid WebSocket key: "' + k + '". Dropping connection');
                    this.connection.destroy();
                    return false;
                }

                n /= spaces;

                md5.update(String.fromCharCode(
                    n >> 24 & 0xFF,
                    n >> 16 & 0xFF,
                    n >> 8  & 0xFF,
                    n       & 0xFF));
            });

            md5.update(this.upgradeHead.toString('binary'));

            try {
                this.connection.write(headers.concat('', '').join('\r\n') + md5.digest('binary'), 'binary');
            } catch(e){
                this._onClose();
            }
        }

        return true;
    } catch (e) {
        this._onClose();
    }

to prevent this

from socket.io.

kmike avatar kmike commented on May 7, 2024

This also apply for accessing websocket url directly:

/Users/kmike/dev/node-try/Socket.IO-node/lib/socket.io/transports/websocket.js:25
    this.connection.setTimeout(0);
                 ^
TypeError: Object #<a ServerResponse> has no method 'setTimeout'
    at [object Object]._onConnect (/Users/kmike/dev/node-try/Socket.IO-node/lib/socket.io/transports/websocket.js:25:18)
    at [object Object].<anonymous> (/Users/kmike/dev/node-try/Socket.IO-node/lib/socket.io/client.js:17:7)
    at new <anonymous> (/Users/kmike/dev/node-try/Socket.IO-node/lib/socket.io/transports/websocket.js:9:9)
    at [object Object]._onConnection (/Users/kmike/dev/node-try/Socket.IO-node/lib/socket.io/listener.js:123:73)
    at [object Object].check (/Users/kmike/dev/node-try/Socket.IO-node/lib/socket.io/listener.js:83:9)
    at Server.<anonymous> (/Users/kmike/dev/node-try/Socket.IO-node/lib/socket.io/listener.js:39:12)
    at Server.emit (events:33:26)
    at HTTPParser.onIncoming (http:825:10)
    at HTTPParser.onHeadersComplete (http:87:31)
    at Stream.ondata (http:757:22)

I think it's quite a serious error because the entire server can be shut down just by visiting public-available url.

from socket.io.

chanon avatar chanon commented on May 7, 2024

I can replicate crashing node.js by accessing the websocket url.
just type in url
http://localhost/socket.io/websocket
in web browser to crash node server.
I think that's pretty serious.

from socket.io.

rauchg avatar rauchg commented on May 7, 2024
  30 Aug 16:53:22 - WebSocket connection invalid

is what you get now

from socket.io.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.