socket.io-parser - npm Package Compare versions

Comparing version 3.3.4 to 3.3.5

index.js

@@ -221,4 +221,8 @@
 
-function Decoder() {
+function Decoder(opts) {
   this.reconstructor = null;
+  opts = opts || {};
+  this.opts = {
+    maxAttachments: opts.maxAttachments || 10,
+  };
 }
@@ -246,3 +250,3 @@
     }
-    packet = decodeString(obj);
+    packet = decodeString(obj, this.opts.maxAttachments);
     if (exports.BINARY_EVENT === packet.type || exports.BINARY_ACK === packet.type) { // binary packet's json
@@ -297,2 +301,3 @@ this.reconstructor = new BinaryReconstructor(packet);
  * @param {String} str
+ * @param {Number} maxAttachments - the maximum number of binary attachments
  * @return {Object} packet
@@ -302,3 +307,3 @@ * @api private
 
-function decodeString(str) {
+function decodeString(str, maxAttachments) {
   var i = 0;
@@ -322,3 +327,9 @@ // look up type
     }
-    p.attachments = Number(buf);
+    var n = Number(buf);
+    if (!isInteger(n) || n < 0) {
+      throw new Error("Illegal attachments");
+    } else if (n > maxAttachments) {
+      throw new Error("too many attachments");
+    }
+    p.attachments = n;
   }
@@ -440,1 +451,11 @@
 }
+
+var isInteger =
+  Number.isInteger ||
+  function (value) {
+    return (
+      typeof value === "number" &&
+      isFinite(value) &&
+      Math.floor(value) === value
+    );
+  };

package.json

 {
   "name": "socket.io-parser",
-  "version": "3.3.4",
+  "version": "3.3.5",
   "description": "socket.io protocol parser",
   "repository": {
     "type": "git",
-    "url": "https://github.com/Automattic/socket.io-parser.git"
+    "url": "git+https://github.com/socketio/socket.io.git"
   },
@@ -9,0 +9,0 @@ "files": [

No alert changes

Improved metrics

Total package byte prevSize

17925

3.29%

Lines of code

530

3.92%

No dependency changes