Mirrors/uppy
1
0
Fork 0
mirror of https://github.com/transloadit/uppy.git synced 2026-01-23 02:25:07 +00:00
Code Issues Projects Releases Wiki Activity

fix the server crashing due a malformed json in websocket message (#5920)

Browse source 
You can verify it using:

```
<!DOCTYPE html>
<html lang="en">

<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>Media API PoC</title>
</head>

<body>
  <h1>Media API Cross-Site WebSocket Hijacking PoC</h1>

  <script>
    let ws = new WebSocket("wss://<url + base path>/api/poc");
    ws.onopen = function () {
        console.log("WebSocket connection established.");
        ws.send("Malformed JSON");
    };
  </script>
</body>

</html>
```
This commit is contained in:
Nik Graf 2025-08-28 22:33:05 +02:00 • committed by GitHub
parent d4bdb463c1
commit 7e5acf105f
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 13 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

5
.changeset/afraid-cobras-fix.md Normal file
View file

@ -0,0 +1,5 @@
---
"@uppy/companion": patch
---
fix the server crashing due a malformed json in a websocket message

12
packages/@uppy/companion/src/server/socket.js
View file

@ -73,10 +73,14 @@ export default function setupSocket(server) {
})
ws.on('message', (jsonData) => {
const data = JSON.parse(jsonData.toString())
// whitelist triggered actions
if (['pause', 'resume', 'cancel'].includes(data.action)) {
emitter().emit(`${data.action}:${token}`)
try {
const data = JSON.parse(jsonData.toString())
// whitelist triggered actions
if (['pause', 'resume', 'cancel'].includes(data.action)) {
emitter().emit(`${data.action}:${token}`)
}
} catch (err) {
logger.error(err, 'websocket.error', Uploader.shortenToken(token))
}
})