Skip to content

Commit

Permalink
fix(uws): handle invalid websocket upgrades
Browse files Browse the repository at this point in the history
When binding to an uWebSockets.js App, there was an unhandled case that
could crash the server:

```
curl "http://localhost:3000/engine.io/?EIO=4&transport=websocket"
```

would result in:

```
Error: Returning from a request handler without responding or attaching an abort handler is forbidden!
terminate called without an active exception
```

Note: this does not apply to the default server based on ws, because
the error was caught elsewhere in the source code.

Related: socketio/socket.io#4250
  • Loading branch information
darrachequesne committed Jan 14, 2022
1 parent a84595a commit 8b4d6a8
Show file tree
Hide file tree
Showing 3 changed files with 11 additions and 5 deletions.
7 changes: 7 additions & 0 deletions lib/server.ts
Expand Up @@ -245,6 +245,13 @@ export abstract class BaseServer extends EventEmitter {
});
}

if (transport === "websocket" && !upgrade) {
debug("invalid transport upgrade");
return fn(Server.errors.BAD_REQUEST, {
name: "TRANSPORT_HANDSHAKE_ERROR"
});
}

if (!this.opts.allowRequest) return fn();

return this.opts.allowRequest(req, (message, success) => {
Expand Down
4 changes: 4 additions & 0 deletions lib/userver.ts
Expand Up @@ -28,6 +28,10 @@ export class uServer extends BaseServer {
req.connection = {
remoteAddress: Buffer.from(res.getRemoteAddressAsText()).toString()
};

res.onAborted(() => {
debug("response has been aborted");
});
}

protected createTransport(transportName, req) {
Expand Down
5 changes: 0 additions & 5 deletions test/server.js
Expand Up @@ -603,9 +603,6 @@ describe("server", () => {
});

it("should disallow bad requests (handshake error)", function(done) {
if (process.env.EIO_WS_ENGINE === "uws") {
return this.skip();
}
const partialDone = createPartialDone(done, 2);

engine = listen(
Expand All @@ -618,8 +615,6 @@ describe("server", () => {
expect(err.code).to.be(3);
expect(err.message).to.be("Bad request");
expect(err.context.name).to.be("TRANSPORT_HANDSHAKE_ERROR");
expect(err.context.error).to.be.an(Error);
expect(err.context.error.name).to.be("TypeError");
partialDone();
});

Expand Down

0 comments on commit 8b4d6a8

Please sign in to comment.