@mswjs/interceptors - npm Package Compare versions

Comparing version 0.41.0 to 0.41.1

lib/browser/interceptors/WebSocket/index.cjs

@@ -190,3 +190,3 @@ const require_createRequestId = require('../../createRequestId-Cs4oXfa1.cjs');
 		this._onclose = null;
-		this.url = url.toString();
+		this.url = resolveWebSocketUrl(url);
 		this.protocol = "";
@@ -302,2 +302,22 @@ this.extensions = "";
 }
+/**
+* Resolve potentially relative WebSocket URLs the same way
+* the browser does (replace the protocol, use the origin, etc).
+*
+* @see https://websockets.spec.whatwg.org//#dom-websocket-websocket
+*/
+function resolveWebSocketUrl(url) {
+	if (typeof url === "string") return resolveWebSocketUrl(new URL(url, typeof location !== "undefined" ? location.href : void 0));
+	if (url.protocol === "http:") url.protocol = "ws:";
+	else if (url.protocol === "https:") url.protocol = "wss:";
+	if (url.protocol !== "ws:" && url.protocol !== "wss:")
+ /**
+	* @note These errors are modeled after the browser errors.
+	* The exact error messages aren't provided in the specification.
+	* Node.js uses more obscure error messages that I don't wish to replicate.
+	*/
+	throw new SyntaxError(`Failed to construct 'WebSocket': The URL's scheme must be either 'http', 'https', 'ws', or 'wss'. '${url.protocol}' is not allowed.`);
+	if (url.hash !== "") throw new SyntaxError(`Failed to construct 'WebSocket': The URL contains a fragment identifier ('${url.hash}'). Fragment identifiers are not allowed in WebSocket URLs.`);
+	return url.href;
+}
 
@@ -304,0 +324,0 @@ //#endregion

lib/browser/interceptors/WebSocket/index.mjs

@@ -190,3 +190,3 @@ import { r as Interceptor, t as createRequestId } from "../../createRequestId-DQcIlohW.mjs";
 		this._onclose = null;
-		this.url = url.toString();
+		this.url = resolveWebSocketUrl(url);
 		this.protocol = "";
@@ -302,2 +302,22 @@ this.extensions = "";
 }
+/**
+* Resolve potentially relative WebSocket URLs the same way
+* the browser does (replace the protocol, use the origin, etc).
+*
+* @see https://websockets.spec.whatwg.org//#dom-websocket-websocket
+*/
+function resolveWebSocketUrl(url) {
+	if (typeof url === "string") return resolveWebSocketUrl(new URL(url, typeof location !== "undefined" ? location.href : void 0));
+	if (url.protocol === "http:") url.protocol = "ws:";
+	else if (url.protocol === "https:") url.protocol = "wss:";
+	if (url.protocol !== "ws:" && url.protocol !== "wss:")
+ /**
+	* @note These errors are modeled after the browser errors.
+	* The exact error messages aren't provided in the specification.
+	* Node.js uses more obscure error messages that I don't wish to replicate.
+	*/
+	throw new SyntaxError(`Failed to construct 'WebSocket': The URL's scheme must be either 'http', 'https', 'ws', or 'wss'. '${url.protocol}' is not allowed.`);
+	if (url.hash !== "") throw new SyntaxError(`Failed to construct 'WebSocket': The URL contains a fragment identifier ('${url.hash}'). Fragment identifiers are not allowed in WebSocket URLs.`);
+	return url.href;
+}
 
@@ -304,0 +324,0 @@ //#endregion

package.json

@@ -5,3 +5,3 @@ {
   "description": "Low-level HTTP/HTTPS/XHR/fetch request interception library.",
-  "version": "0.41.0",
+  "version": "0.41.1",
   "main": "./lib/node/index.cjs",
@@ -8,0 +8,0 @@ "module": "./lib/node/index.mjs",

src/interceptors/WebSocket/WebSocketClientConnection.ts

@@ -22,3 +22,3 @@ import type { WebSocketData, WebSocketTransport } from './WebSocketTransport'
   public abstract addEventListener<
-    EventType extends keyof WebSocketClientEventMap
+    EventType extends keyof WebSocketClientEventMap,
   >(
@@ -31,3 +31,3 @@ type: EventType,
   public abstract removeEventListener<
-    EventType extends keyof WebSocketClientEventMap
+    EventType extends keyof WebSocketClientEventMap,
   >(
@@ -45,5 +45,3 @@ event: EventType,
  */
-export class WebSocketClientConnection
-  implements WebSocketClientConnectionProtocol
-{
+export class WebSocketClientConnection implements WebSocketClientConnectionProtocol {
   public readonly id: string
@@ -50,0 +48,0 @@ public readonly url: URL

src/interceptors/WebSocket/WebSocketOverride.ts

 import { invariant } from 'outvariant'
+import { DeferredPromise } from '@open-draft/deferred-promise'
 import type { WebSocketData } from './WebSocketTransport'
 import { bindEvent } from './utils/bindEvent'
 import { CloseEvent } from './utils/events'
-import { DeferredPromise } from '@open-draft/deferred-promise'
 
 export type WebSocketEventListener<
-  EventType extends WebSocketEventMap[keyof WebSocketEventMap] = Event
+  EventType extends WebSocketEventMap[keyof WebSocketEventMap] = Event,
 > = (this: WebSocket, event: EventType) => void
@@ -47,3 +47,3 @@
     super()
-    this.url = url.toString()
+    this.url = resolveWebSocketUrl(url)
     this.protocol = ''
@@ -66,4 +66,4 @@ this.extensions = ''
           : Array.isArray(protocols) && protocols.length > 0
-          ? protocols[0]
-          : ''
+            ? protocols[0]
+            : ''
 
@@ -254,1 +254,47 @@ /**
 }
+
+/**
+ * Resolve potentially relative WebSocket URLs the same way
+ * the browser does (replace the protocol, use the origin, etc).
+ *
+ * @see https://websockets.spec.whatwg.org//#dom-websocket-websocket
+ */
+function resolveWebSocketUrl(url: string | URL): string {
+  if (typeof url === 'string') {
+    /**
+     * @note Cast the string to a URL first so the parsing errors
+     * are thrown as a part of the WebSocket constructor, not consumers.
+     */
+    const urlRecord = new URL(
+      url,
+      typeof location !== 'undefined' ? location.href : undefined
+    )
+
+    return resolveWebSocketUrl(urlRecord)
+  }
+
+  if (url.protocol === 'http:') {
+    url.protocol = 'ws:'
+  } else if (url.protocol === 'https:') {
+    url.protocol = 'wss:'
+  }
+
+  if (url.protocol !== 'ws:' && url.protocol !== 'wss:') {
+    /**
+     * @note These errors are modeled after the browser errors.
+     * The exact error messages aren't provided in the specification.
+     * Node.js uses more obscure error messages that I don't wish to replicate.
+     */
+    throw new SyntaxError(
+      `Failed to construct 'WebSocket': The URL's scheme must be either 'http', 'https', 'ws', or 'wss'. '${url.protocol}' is not allowed.`
+    )
+  }
+
+  if (url.hash !== '') {
+    throw new SyntaxError(
+      `Failed to construct 'WebSocket': The URL contains a fragment identifier ('${url.hash}'). Fragment identifiers are not allowed in WebSocket URLs.`
+    )
+  }
+
+  return url.href
+}

src/interceptors/WebSocket/WebSocketServerConnection.ts

@@ -33,3 +33,3 @@ import { invariant } from 'outvariant'
   public abstract addEventListener<
-    EventType extends keyof WebSocketServerEventMap
+    EventType extends keyof WebSocketServerEventMap,
   >(
@@ -42,3 +42,3 @@ event: EventType,
   public abstract removeEventListener<
-    EventType extends keyof WebSocketServerEventMap
+    EventType extends keyof WebSocketServerEventMap,
   >(
@@ -56,5 +56,3 @@ event: EventType,
  */
-export class WebSocketServerConnection
-  implements WebSocketServerConnectionProtocol
-{
+export class WebSocketServerConnection implements WebSocketServerConnectionProtocol {
   /**
@@ -61,0 +59,0 @@ * A WebSocket instance connected to the original server.

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 4 instances in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

Network access

Supply chain risk

This module accesses the network.

Found 4 instances in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

1520480

0.49%

Lines of code

18364

0.42%

Number of low supply chain risk alerts

37

-9.76%

Number of medium supply chain risk alerts

173

-0.57%

No dependency changes