socket.io-parser - npm Package Compare versions

Comparing version 4.2.5 to 4.2.6

build/cjs/index.d.ts

@@ -56,2 +56,14 @@ import { Emitter } from "@socket.io/component-emitter";
 }
+type JSONReviver = (this: any, key: string, value: any) => any;
+export interface DecoderOptions {
+    /**
+     * Custom reviver to pass down to JSON.parse()
+     */
+    reviver?: JSONReviver;
+    /**
+     * Maximum number of binary attachments per packet
+     * @default 10
+     */
+    maxAttachments?: number;
+}
 /**
@@ -63,10 +75,8 @@ * A socket.io Decoder instance
 export declare class Decoder extends Emitter<{}, {}, DecoderReservedEvents> {
-    private reviver?;
     private reconstructor;
+    private opts;
     /**
      * Decoder constructor
-     *
-     * @param {function} reviver - custom reviver to pass down to JSON.stringify
      */
-    constructor(reviver?: (this: any, key: string, value: any) => any);
+    constructor(opts?: DecoderOptions | JSONReviver);
     /**
@@ -73,0 +83,0 @@ * Decodes an encoded packet string into packet JSON.

build/cjs/index.js

@@ -120,8 +120,9 @@ "use strict";
      * Decoder constructor
-     *
-     * @param {function} reviver - custom reviver to pass down to JSON.stringify
      */
-    constructor(reviver) {
+    constructor(opts) {
         super();
-        this.reviver = reviver;
+        this.opts = Object.assign({
+            reviver: undefined,
+            maxAttachments: 10,
+        }, typeof opts === "function" ? { reviver: opts } : opts);
     }
@@ -197,3 +198,10 @@ /**
             }
-            p.attachments = Number(buf);
+            const n = Number(buf);
+            if (!isInteger(n) || n < 0) {
+                throw new Error("Illegal attachments");
+            }
+            else if (n > this.opts.maxAttachments) {
+                throw new Error("too many attachments");
+            }
+            p.attachments = n;
         }
@@ -245,3 +253,3 @@ // look up namespace (if any)
         try {
-            return JSON.parse(str, this.reviver);
+            return JSON.parse(str, this.opts.reviver);
         }
@@ -248,0 +256,0 @@ catch (e) {

build/esm-debug/index.d.ts

@@ -56,2 +56,14 @@ import { Emitter } from "@socket.io/component-emitter";
 }
+type JSONReviver = (this: any, key: string, value: any) => any;
+export interface DecoderOptions {
+    /**
+     * Custom reviver to pass down to JSON.parse()
+     */
+    reviver?: JSONReviver;
+    /**
+     * Maximum number of binary attachments per packet
+     * @default 10
+     */
+    maxAttachments?: number;
+}
 /**
@@ -63,10 +75,8 @@ * A socket.io Decoder instance
 export declare class Decoder extends Emitter<{}, {}, DecoderReservedEvents> {
-    private reviver?;
     private reconstructor;
+    private opts;
     /**
      * Decoder constructor
-     *
-     * @param {function} reviver - custom reviver to pass down to JSON.stringify
      */
-    constructor(reviver?: (this: any, key: string, value: any) => any);
+    constructor(opts?: DecoderOptions | JSONReviver);
     /**
@@ -73,0 +83,0 @@ * Decodes an encoded packet string into packet JSON.

build/esm-debug/index.js

@@ -115,8 +115,9 @@ import { Emitter } from "@socket.io/component-emitter";
      * Decoder constructor
-     *
-     * @param {function} reviver - custom reviver to pass down to JSON.stringify
      */
-    constructor(reviver) {
+    constructor(opts) {
         super();
-        this.reviver = reviver;
+        this.opts = Object.assign({
+            reviver: undefined,
+            maxAttachments: 10,
+        }, typeof opts === "function" ? { reviver: opts } : opts);
     }
@@ -192,3 +193,10 @@ /**
             }
-            p.attachments = Number(buf);
+            const n = Number(buf);
+            if (!isInteger(n) || n < 0) {
+                throw new Error("Illegal attachments");
+            }
+            else if (n > this.opts.maxAttachments) {
+                throw new Error("too many attachments");
+            }
+            p.attachments = n;
         }
@@ -240,3 +248,3 @@ // look up namespace (if any)
         try {
-            return JSON.parse(str, this.reviver);
+            return JSON.parse(str, this.opts.reviver);
         }
@@ -243,0 +251,0 @@ catch (e) {

build/esm/index.d.ts

@@ -56,2 +56,14 @@ import { Emitter } from "@socket.io/component-emitter";
 }
+type JSONReviver = (this: any, key: string, value: any) => any;
+export interface DecoderOptions {
+    /**
+     * Custom reviver to pass down to JSON.parse()
+     */
+    reviver?: JSONReviver;
+    /**
+     * Maximum number of binary attachments per packet
+     * @default 10
+     */
+    maxAttachments?: number;
+}
 /**
@@ -63,10 +75,8 @@ * A socket.io Decoder instance
 export declare class Decoder extends Emitter<{}, {}, DecoderReservedEvents> {
-    private reviver?;
     private reconstructor;
+    private opts;
     /**
      * Decoder constructor
-     *
-     * @param {function} reviver - custom reviver to pass down to JSON.stringify
      */
-    constructor(reviver?: (this: any, key: string, value: any) => any);
+    constructor(opts?: DecoderOptions | JSONReviver);
     /**
@@ -73,0 +83,0 @@ * Decodes an encoded packet string into packet JSON.

build/esm/index.js

@@ -111,8 +111,9 @@ import { Emitter } from "@socket.io/component-emitter";
      * Decoder constructor
-     *
-     * @param {function} reviver - custom reviver to pass down to JSON.stringify
      */
-    constructor(reviver) {
+    constructor(opts) {
         super();
-        this.reviver = reviver;
+        this.opts = Object.assign({
+            reviver: undefined,
+            maxAttachments: 10,
+        }, typeof opts === "function" ? { reviver: opts } : opts);
     }
@@ -188,3 +189,10 @@ /**
             }
-            p.attachments = Number(buf);
+            const n = Number(buf);
+            if (!isInteger(n) || n < 0) {
+                throw new Error("Illegal attachments");
+            }
+            else if (n > this.opts.maxAttachments) {
+                throw new Error("too many attachments");
+            }
+            p.attachments = n;
         }
@@ -235,3 +243,3 @@ // look up namespace (if any)
         try {
-            return JSON.parse(str, this.reviver);
+            return JSON.parse(str, this.opts.reviver);
         }
@@ -238,0 +246,0 @@ catch (e) {

package.json

 {
   "name": "socket.io-parser",
-  "version": "4.2.5",
+  "version": "4.2.6",
   "description": "socket.io protocol parser",
@@ -5,0 +5,0 @@ "homepage": "https://github.com/socketio/socket.io/tree/main/packages/socket.io-client#readme",

Fixed alerts

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Improved metrics

Total package byte prevSize

64097

2.46%

Lines of code

1875

2.97%

Number of low supply chain risk alerts

1

-50%

No dependency changes