fix: ensure the packet contains a valid event name

socketio · May 22, 2023 · 88a40b9 · 88a40b9
1 parent 28dd668
commit 88a40b9
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/lib/index.ts b/lib/index.ts
@@ -275,7 +275,10 @@ export class Decoder extends Emitter<{}, {}, DecoderReservedEvents> {
         return typeof payload === "string" || typeof payload === "object";
       case PacketType.EVENT:
       case PacketType.BINARY_EVENT:
-        return Array.isArray(payload) && payload.length > 0;
+        return (
+          Array.isArray(payload) &&
+          (typeof payload[0] === "string" || typeof payload[0] === "number")
+        );
       case PacketType.ACK:
       case PacketType.BINARY_ACK:
         return Array.isArray(payload);

diff --git a/test/parser.js b/test/parser.js
@@ -118,6 +118,9 @@ describe("socket.io-parser", () => {
     isInvalidPayload("1/admin,{}");
     isInvalidPayload('2/admin,"invalid');
     isInvalidPayload("2/admin,{}");
+    isInvalidPayload('2[{"toString":"foo"}]');
+    isInvalidPayload('2[true,"foo"]');
+    isInvalidPayload('2[null,"bar"]');
 
     expect(() => new Decoder().add("999")).to.throwException(
       /^unknown packet type 9$/