Make history and remote message handling fail closed

2026-08-13 21:34:30 +02:00
parent 06a3cfc050
commit c1003074cd
4 changed files with 97 additions and 9 deletions
@@ -98,6 +98,17 @@ class RemoteServer {
      const client = this._clients.get(ws);
      if (!client) return;

+      if (!msg || typeof msg !== 'object' || Array.isArray(msg)) {
+        if (!client.authenticated) {
+          authReceived = true;
+          clearTimeout(authTimeout);
+          this._recordFailedAttempt(ip);
+          ws.close(4002, 'Invalid token');
+          this._clients.delete(ws);
+        }
+        return;
+      }
+
      if (!client.authenticated) {
        authReceived = true;
        clearTimeout(authTimeout);