Socket
Book a DemoSign in
Socket
Book a DemoSign in

undici

Package Overview
Dependencies
Maintainers
3
Versions
272
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

undici - npm Package Compare versions

Comparing version
7.24.1
 to
7.24.2
+0
-21
docs/docs/api/WebSocket.md

@@ -21,3 +21,2 @@ # Class: WebSocket

* **headers** `HeadersInit` (optional) - Custom headers to include in the WebSocket handshake request.
* **maxDecompressedMessageSize** `number` (optional) - Maximum allowed size in bytes for decompressed messages when using the `permessage-deflate` extension. **Default:** `4194304` (4 MB).

@@ -47,22 +46,2 @@ ### Example:

### Example with custom decompression limit:
To protect against decompression bombs (small compressed payloads that expand to very large sizes), you can set a custom limit:
```mjs
import { WebSocket } from 'undici'
// Limit decompressed messages to 1 MB
const ws = new WebSocket('wss://echo.websocket.events', {
maxDecompressedMessageSize: 1 * 1024 * 1024
})
ws.addEventListener('error', (event) => {
// Connection will be closed if a message exceeds the limit
console.error('WebSocket error:', event.error)
})
```
> ⚠️ **Security Note**: The `maxDecompressedMessageSize` option protects against memory exhaustion attacks where a malicious server sends a small compressed payload that decompresses to an extremely large size. If you increase this limit significantly above the default, ensure your application can handle the increased memory usage.
### Example with HTTP/2:

@@ -69,0 +48,0 @@ 

+2
-7
lib/web/websocket/permessage-deflate.js

@@ -20,5 +20,2 @@ 'use strict'

/** @type {number} */
#maxDecompressedSize
/** @type {boolean} */

@@ -32,8 +29,6 @@ #aborted = false

* @param {Map<string, string>} extensions
* @param {{ maxDecompressedMessageSize?: number }} [options]
*/
constructor (extensions, options = {}) {
constructor (extensions) {
this.#options.serverNoContextTakeover = extensions.has('server_no_context_takeover')
this.#options.serverMaxWindowBits = extensions.get('server_max_window_bits')
this.#maxDecompressedSize = options.maxDecompressedMessageSize ?? kDefaultMaxDecompressedSize
}

@@ -80,3 +75,3 @@

if (this.#inflate[kLength] > this.#maxDecompressedSize) {
if (this.#inflate[kLength] > kDefaultMaxDecompressedSize) {
this.#aborted = true

@@ -83,0 +78,0 @@ this.#inflate.removeAllListeners()

+2
-7
lib/web/websocket/receiver.js

@@ -42,11 +42,7 @@ 'use strict'

/** @type {{ maxDecompressedMessageSize?: number }} */
#options
/**
* @param {import('./websocket').Handler} handler
* @param {Map<string, string>|null} extensions
* @param {{ maxDecompressedMessageSize?: number }} [options]
*/
constructor (handler, extensions, options = {}) {
constructor (handler, extensions) {
super()

@@ -56,6 +52,5 @@

this.#extensions = extensions == null ? new Map() : extensions
this.#options = options
if (this.#extensions.has('permessage-deflate')) {
this.#extensions.set('permessage-deflate', new PerMessageDeflate(extensions, options))
this.#extensions.set('permessage-deflate', new PerMessageDeflate(extensions))
}

@@ -62,0 +57,0 @@ }

+1
-21
lib/web/websocket/websocket.js

@@ -112,4 +112,2 @@ 'use strict'

#parser
/** @type {{ maxDecompressedMessageSize?: number }} */
#options

@@ -160,7 +158,2 @@ /**

// Store options for later use (e.g., maxDecompressedMessageSize)
this.#options = {
maxDecompressedMessageSize: options.maxDecompressedMessageSize
}
// 6. Let client be this's relevant settings object.

@@ -468,3 +461,3 @@ const client = environmentSettingsObject.settingsObject

const parser = new ByteParser(this.#handler, parsedExtensions, this.#options)
const parser = new ByteParser(this.#handler, parsedExtensions)
parser.on('drain', () => this.#handler.onParserDrain())

@@ -721,15 +714,2 @@ parser.on('error', (err) => this.#handler.onParserError(err))

converter: webidl.nullableConverter(webidl.converters.HeadersInit)
},
{
key: 'maxDecompressedMessageSize',
converter: webidl.nullableConverter((V) => {
V = webidl.converters['unsigned long long'](V)
if (V <= 0) {
throw webidl.errors.exception({
header: 'WebSocket constructor',
message: 'maxDecompressedMessageSize must be greater than 0'
})
}
return V
})
}

@@ -736,0 +716,0 @@ ])

+1
-1
package.json
{
"name": "undici",
"version": "7.24.1",
"version": "7.24.2",
"description": "An HTTP/1.1 client, written from scratch for Node.js",

@@ -5,0 +5,0 @@ "homepage": "https://undici.nodejs.org",

+1
-8
types/websocket.d.ts

@@ -150,10 +150,3 @@ /// <reference types="node" />

dispatcher?: Dispatcher,
headers?: HeadersInit,
/**
* Maximum size in bytes for decompressed WebSocket messages.
* When a message exceeds this limit during decompression, the connection
* will be closed with status code 1009 (Message Too Big).
* @default 4194304 (4 MB)
*/
maxDecompressedMessageSize?: number
headers?: HeadersInit
}

@@ -160,0 +153,0 @@ 

lib/web/fetch/index.js

Sorry, the diff of this file is too big to display