socket.io-parser - npm Package Compare versions

Comparing version 2.2.2 to 2.2.3

History.md

 
+2.2.3 / 2015-02-03
+==================
+
+ * index: fix potential infinite loop with malicious binary packet
+
 2.2.2 / 2014-09-04
@@ -3,0 +8,0 @@ ==================

index.js

@@ -243,3 +243,3 @@
       // no attachments, labeled binary but no binary data to follow
-      if (this.reconstructor.reconPack.attachments == 0) {
+      if (this.reconstructor.reconPack.attachments === 0) {
         this.emit('decoded', packet);
@@ -285,7 +285,11 @@ }
   if (exports.BINARY_EVENT == p.type || exports.BINARY_ACK == p.type) {
-    p.attachments = '';
+    var buf = '';
     while (str.charAt(++i) != '-') {
-      p.attachments += str.charAt(i);
+      buf += str.charAt(i);
+      if (i + 1 == str.length) break;
     }
-    p.attachments = Number(p.attachments);
+    if (buf != Number(buf) || str.charAt(i) != '-') {
+      throw new Error('Illegal attachments');
+    }
+    p.attachments = Number(buf);
   }
@@ -308,3 +312,3 @@
   var next = str.charAt(i + 1);
-  if ('' != next && Number(next) == next) {
+  if ('' !== next && Number(next) == next) {
     p.id = '';
@@ -311,0 +315,0 @@ while (++i) {

package.json

 {
   "name": "socket.io-parser",
-  "version": "2.2.2",
+  "version": "2.2.3",
   "description": "socket.io protocol parser",
@@ -5,0 +5,0 @@ "repository": {

No alert changes

Improved metrics

Total package byte prevSize

19178

increased by1.2%

Lines of code

550

increased by0.73%

No dependency changes