Skip to content

Commit 78c676d

Browse files
committed
[security] Fix ReDoS vulnerability
A specially crafted value of the `Sec-Websocket-Protocol` header could be used to significantly slow down a ws server. PoC and fix were sent privately by Robert McLaughlin from University of California, Santa Barbara.
1 parent d57db27 commit 78c676d

File tree

1 file changed

+13
-1
lines changed

1 file changed

+13
-1
lines changed

lib/websocket-server.js

+13-1
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ class WebSocketServer extends EventEmitter {
280280
var protocol = req.headers['sec-websocket-protocol'];
281281

282282
if (protocol) {
283-
protocol = protocol.trim().split(/ *, */);
283+
protocol = protocol.split(',').map(trim);
284284

285285
//
286286
// Optionally call external protocol selection handler.
@@ -399,3 +399,15 @@ function abortHandshake(socket, code, message, headers) {
399399
socket.removeListener('error', socketOnError);
400400
socket.destroy();
401401
}
402+
403+
/**
404+
* Remove whitespace characters from both ends of a string.
405+
*
406+
* @param {String} str The string
407+
* @return {String} A new string representing `str` stripped of whitespace
408+
* characters from both its beginning and end
409+
* @private
410+
*/
411+
function trim(str) {
412+
return str.trim();
413+
}

0 commit comments

Comments
 (0)