graphql-ws - npm Package Compare versions

Comparing version 5.6.0 to 5.6.1

lib/server.d.ts

@@ -7,3 +7,3 @@ /**
 import { OperationTypeNode, GraphQLSchema, ExecutionArgs, validate as graphqlValidate, GraphQLError, SubscriptionArgs } from 'graphql';
-import { ID, ConnectionInitMessage, SubscribeMessage, NextMessage, ErrorMessage, CompleteMessage, JSONMessageReplacer, JSONMessageReviver, PingMessage, PongMessage, ExecutionResult, ExecutionPatchResult } from './common';
+import { GRAPHQL_TRANSPORT_WS_PROTOCOL, ID, ConnectionInitMessage, SubscribeMessage, NextMessage, ErrorMessage, CompleteMessage, JSONMessageReplacer, JSONMessageReviver, PingMessage, PongMessage, ExecutionResult, ExecutionPatchResult } from './common';
 /** @category Server */
@@ -404,1 +404,14 @@ export declare type OperationResult = Promise<AsyncGenerator<ExecutionResult | ExecutionPatchResult> | AsyncIterable<ExecutionResult | ExecutionPatchResult> | ExecutionResult> | AsyncGenerator<ExecutionResult | ExecutionPatchResult> | AsyncIterable<ExecutionResult | ExecutionPatchResult> | ExecutionResult;
 export declare function makeServer<P extends ConnectionInitMessage['payload'] = ConnectionInitMessage['payload'], E = unknown>(options: ServerOptions<P, E>): Server<E>;
+/**
+ * Helper utility for choosing the "graphql-transport-ws" subprotocol from
+ * a set of WebSocket subprotocols.
+ *
+ * Accepts a set of already extracted WebSocket subprotocols or the raw
+ * Sec-WebSocket-Protocol header value. In either case, if the right
+ * protocol appears, it will be returned.
+ *
+ * By specification, the server should not provide a value with Sec-WebSocket-Protocol
+ * if it does not agree with client's subprotocols. The client has a responsibility
+ * to handle the connection afterwards.
+ */
+export declare function handleProtocols(protocols: Set<string> | string): typeof GRAPHQL_TRANSPORT_WS_PROTOCOL | false;

lib/server.js

@@ -15,3 +15,3 @@ "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.makeServer = void 0;
+exports.handleProtocols = exports.makeServer = void 0;
 const graphql_1 = require("graphql");
@@ -262,1 +262,24 @@ const common_1 = require("./common");
 exports.makeServer = makeServer;
+/**
+ * Helper utility for choosing the "graphql-transport-ws" subprotocol from
+ * a set of WebSocket subprotocols.
+ *
+ * Accepts a set of already extracted WebSocket subprotocols or the raw
+ * Sec-WebSocket-Protocol header value. In either case, if the right
+ * protocol appears, it will be returned.
+ *
+ * By specification, the server should not provide a value with Sec-WebSocket-Protocol
+ * if it does not agree with client's subprotocols. The client has a responsibility
+ * to handle the connection afterwards.
+ */
+function handleProtocols(protocols) {
+    return (typeof protocols === 'string'
+        ? protocols
+            .split(',')
+            .map((p) => p.trim())
+            .includes(common_1.GRAPHQL_TRANSPORT_WS_PROTOCOL)
+        : protocols.has(common_1.GRAPHQL_TRANSPORT_WS_PROTOCOL))
+        ? common_1.GRAPHQL_TRANSPORT_WS_PROTOCOL
+        : false;
+}
+exports.handleProtocols = handleProtocols;

lib/use/fastify-websocket.js

@@ -29,2 +29,4 @@ "use strict";
         const { socket } = connection;
+        // might be too late, but meh
+        this.websocketServer.options.handleProtocols = server_1.handleProtocols;
         // handle server emitted errors only if not already handling
@@ -31,0 +33,0 @@ if (!handlingServerEmittedErrors) {

lib/use/uWebSockets.js

@@ -55,6 +55,7 @@ "use strict";
                 },
-            }, req.getHeader('sec-websocket-key'), req.getHeader('sec-websocket-protocol'), req.getHeader('sec-websocket-extensions'), context);
+            }, req.getHeader('sec-websocket-key'), (0, server_1.handleProtocols)(req.getHeader('sec-websocket-protocol')) ||
+                new Uint8Array(), req.getHeader('sec-websocket-extensions'), context);
         },
         open(...args) {
-            var _a, _b;
+            var _a;
             (_a = behavior.open) === null || _a === void 0 ? void 0 : _a.call(behavior, ...args);
@@ -75,3 +76,3 @@ const socket = args[0];
             client.closed = server.opened({
-                protocol: (_b = persistedRequest.headers['sec-websocket-protocol']) !== null && _b !== void 0 ? _b : '',
+                protocol: (0, server_1.handleProtocols)(persistedRequest.headers['sec-websocket-protocol'] || '') || '',
                 send: async (message) => {
@@ -78,0 +79,0 @@ // the socket might have been destroyed in the meantime

lib/use/ws.js

@@ -24,2 +24,3 @@ "use strict";
     const server = (0, server_1.makeServer)(options);
+    ws.options.handleProtocols = server_1.handleProtocols;
     ws.once('error', (err) => {
@@ -26,0 +27,0 @@ console.error('Internal error emitted on the WebSocket server. ' +

package.json

 {
   "name": "graphql-ws",
-  "version": "5.6.0",
+  "version": "5.6.1",
   "description": "Coherent, zero-dependency, lazy, simple, GraphQL over WebSocket Protocol compliant server and client",
@@ -97,4 +97,4 @@ "keywords": [
     "@types/ws": "^8.2.3",
-    "@typescript-eslint/eslint-plugin": "^5.12.0",
-    "@typescript-eslint/parser": "^5.12.0",
+    "@typescript-eslint/eslint-plugin": "^5.12.1",
+    "@typescript-eslint/parser": "^5.12.1",
     "babel-jest": "^27.5.1",
@@ -116,3 +116,3 @@ "eslint": "^8.9.0",
     "tslib": "^2.3.1",
-    "typedoc": "^0.22.11",
+    "typedoc": "^0.22.12",
     "typedoc-plugin-markdown": "^3.11.14",
@@ -119,0 +119,0 @@ "typescript": "^4.5.5",

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

272115

increased by1.1%

Lines of code

4401

increased by1.52%

Worsened metrics

Number of low supply chain risk alerts

7

increased by16.67%

No dependency changes