From 0809c75d50dcba19c3ff4b1bec5c8ec17818d4a3 Mon Sep 17 00:00:00 2001 From: Administrator Date: Sun, 21 Jun 2026 03:06:08 +0200 Subject: [PATCH] =?UTF-8?q?fix(remote-server):=20cap=20WS=20maxPayload=20(?= =?UTF-8?q?256=20KiB)=20+=20guard=20sendToClient=20=E2=80=94=20close=20a?= =?UTF-8?q?=20pre-auth=20parse=20freeze-sink=20and=20a=20send-throw=20cras?= =?UTF-8?q?h?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two isolated hardenings of the opt-in remote/diagnostics WS server, surfaced by the session-wide diagnostics audit: 1. WebSocketServer was created with no maxPayload, so ws defaults to 100 MiB per message. The connection handler runs JSON.parse(raw) on the FIRST message (the auth frame) before authentication, so any peer past the IP allowlist could send a huge payload and force a synchronous multi-MB JSON.parse on the main-process event loop — an unbounded freeze/DoS sink. Diag, auth and WebRTC signaling messages are all small; cap maxPayload at 256 KiB to close it. 2. sendToClient did ws.send(JSON.stringify(data)) with no readyState/try guard (unlike broadcast, which checks ws.readyState === 1). A send on a closing socket, or a stringify throw, escaped the diag-response callback as an uncaughtException — a potential crash. Mirror broadcast: send only when readyState === 1, wrapped in try/catch. Both are isolated to the transport layer with zero redaction surface. The audit's larger finding — server_health doing O(historySize) synchronous work per request (6-7 full-config clones + unbounded history walks) — is a real freeze, but ONLY on the cold opt-in diagnostics path with a large history (this user: 23 rows), and the safe fix cuts into the credential-redaction collectors (which have leaked twice); deferred and documented in tasks/todo.md rather than operated under risk. 397/397 tests pass, eslint clean. Co-Authored-By: Claude Opus 4.8 (1M context) --- lib/remote-server.js | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/remote-server.js b/lib/remote-server.js index 7e246b5..486c5e3 100644 --- a/lib/remote-server.js +++ b/lib/remote-server.js @@ -21,7 +21,7 @@ class RemoteServer { return new Promise((resolve, reject) => { this._config = opts; - const wssOpts = { port: opts.port }; + const wssOpts = { port: opts.port, maxPayload: 256 * 1024 }; if (opts.host) wssOpts.host = opts.host; this._wss = new WebSocketServer(wssOpts, () => { resolve(); @@ -175,7 +175,9 @@ class RemoteServer { sendToClient(clientId, data) { for (const [ws, client] of this._clients) { if (client.id === clientId && client.authenticated) { - ws.send(JSON.stringify(data)); + if (ws.readyState === 1) { + try { ws.send(JSON.stringify(data)); } catch {} + } break; } }