[pull] master from websockets:master - #141
Open
pull[bot] wants to merge 327 commits into
Open
Conversation
lpinca
force-pushed
the
master
branch
2 times, most recently
from
November 8, 2020 08:25
13c5925 to
3d5066a
Compare
lpinca
force-pushed
the
master
branch
3 times, most recently
from
March 7, 2021 16:50
f77215b to
114de9e
Compare
lpinca
force-pushed
the
master
branch
2 times, most recently
from
July 3, 2021 08:15
431cc3e to
aca94c8
Compare
lpinca
force-pushed
the
master
branch
2 times, most recently
from
July 20, 2021 11:33
106cf84 to
c4394c3
Compare
Prevent the `onclose`, `onerror`, `onmessage`, and `onopen` getters and setters from returning or removing event listeners added with `WebSocket.prototype.addEventListener()`. Also prevent `WebSocket.prototype.removeEventListener()` from removing event listeners added with the `onclose`, `onerror`, `onmessage`, and `onopen` setters. Refs: #1818
Make the `onclose`, `onerror`, `onmessage`, and `onopen` getters return `null` instead of `undefined` if the event handler is not set.
- Remove non-standard `OpenEvent` class. - Make properties read-only. - Update constructor signatures to match the ones defined by the HTML standard.
Use the chunk returned by `socket.read()` to handle the buffered data instead of relying on a `'data'` event emitted after the `'close'` event. Refs: nodejs/node#39639
Use the correct error message if the server sends an empty subprotocol name.
Make the `Receiver` constructor take a single options object argument instead of multiple positional arguments.
lpinca
force-pushed
the
master
branch
2 times, most recently
from
August 11, 2021 15:26
856b19d to
26a46f3
Compare
When the `reason` argument for `websocket.close()` is a `TypedArray` instead of a string or `Buffer`, the function does not correctly overwrite the dirty buffer allocated via `Buffer.allocUnsafe()`. This results in the disclosure of uninitialized memory, potentially leaking sensitive data to the remote peer. Add stricter validation for the argument type.
Previously, the receiver could retain one `Buffer` entry per buffered chunk or message fragment until enough data was parsed or the message completed. A peer could use many tiny fragments/chunks and make retained memory scale with retained part count rather than message payload size. Add configurable `maxBufferedChunks` and `maxFragments` options to bound the number of retained parts. When either limit is exceeded, emit a `WS_ERR_TOO_MANY_BUFFERED_PARTS` error and close the connection with close code 1008. Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>
Clarifiy that the values of the `maxBufferedChunks`, `maxFragments`, and `maxPayload` options are coerced to 32-bit signed integers.
Ensure that empty fragments are counted against the `maxFragments` limit.
In Node.js versions >= 22.23.2 < 23.0.0, >= 24.18.1 < 25.0.0, and >= 26.5.1, the HTTP server rejects the request before emitting the `'upgrade'` event. Refs: nodejs/node@064d339f
Direct security reporters to use private vulnerability reporting on GitHub as the primary reporting channel.
This reverts commit 8e9511b. Refs: coverallsapp/github-action@8d6379e1
When a server is configured with `clientMaxWindowBits = N` and a client offers `client_max_window_bits = M` where `M < N`, the server must not respond with a value greater than `M`. Previously the server accepted such offers and responded with `client_max_window_bits = N`. The analogous check for `serverMaxWindowBits` already existed; this commit adds the symmetric check for `clientMaxWindowBits`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )