Skip to content

Commit 4d2d1af

Browse files
KhafraDevmcollina
KhafraDev
and
mcollina
authored
remove maxDecompressedMessageSize (#4891)
* remove maxDecompressedMessageSize * remove maxDecompressedMessageSize * remove maxDecompressedMessageSize * test: remove unused websocket test helpers --------- Co-authored-by: Matteo Collina <hello@matteocollina.com>
1 parent 3a05a4f commit 4d2d1af

6 files changed

Lines changed: 6 additions & 318 deletions

File tree

‎docs/docs/api/WebSocket.md‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ When passing an object as the second argument, the following options are availab
1818
* **protocols** `string | string[]` (optional) - Subprotocol(s) to request the server use.
1919
* **dispatcher** `Dispatcher` (optional) - A custom [`Dispatcher`](/docs/docs/api/Dispatcher.md) to use for the connection.
2020
* **headers** `HeadersInit` (optional) - Custom headers to include in the WebSocket handshake request.
21-
* **maxDecompressedMessageSize** `number` (optional) - Maximum allowed size in bytes for decompressed messages when using the `permessage-deflate` extension. **Default:** `4194304` (4 MB).
2221

2322
### Example:
2423

@@ -43,26 +42,6 @@ import { WebSocket } from 'undici'
4342
const ws = new WebSocket('wss://echo.websocket.events', ['echo', 'chat'])
4443
```
4544

46-
### Example with custom decompression limit:
47-
48-
To protect against decompression bombs (small compressed payloads that expand to very large sizes), you can set a custom limit:
49-
50-
```mjs
51-
import { WebSocket } from 'undici'
52-
53-
// Limit decompressed messages to 1 MB
54-
const ws = new WebSocket('wss://echo.websocket.events', {
55-
maxDecompressedMessageSize: 1 * 1024 * 1024
56-
})
57-
58-
ws.addEventListener('error', (event) => {
59-
// Connection will be closed if a message exceeds the limit
60-
console.error('WebSocket error:', event.error)
61-
})
62-
```
63-
64-
> ⚠️ **Security Note**: The `maxDecompressedMessageSize` option protects against memory exhaustion attacks where a malicious server sends a small compressed payload that decompresses to an extremely large size. If you increase this limit significantly above the default, ensure your application can handle the increased memory usage.
65-
6645
### Example with HTTP/2:
6746

6847
> ⚠️ Warning: WebSocket over HTTP/2 is experimental, it is likely to change in the future.

‎lib/web/websocket/permessage-deflate.js‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ class PerMessageDeflate {
1717

1818
#options = {}
1919

20-
/** @type {number} */
21-
#maxDecompressedSize
22-
2320
/** @type {boolean} */
2421
#aborted = false
2522

@@ -28,12 +25,10 @@ class PerMessageDeflate {
2825

2926
/**
3027
* @param {Map<string, string>} extensions
31-
* @param {{ maxDecompressedMessageSize?: number }} [options]
3228
*/
33-
constructor (extensions, options = {}) {
29+
constructor (extensions) {
3430
this.#options.serverNoContextTakeover = extensions.has('server_no_context_takeover')
3531
this.#options.serverMaxWindowBits = extensions.get('server_max_window_bits')
36-
this.#maxDecompressedSize = options.maxDecompressedMessageSize ?? kDefaultMaxDecompressedSize
3732
}
3833

3934
decompress (chunk, fin, callback) {
@@ -75,7 +70,7 @@ class PerMessageDeflate {
7570

7671
this.#inflate[kLength] += data.length
7772

78-
if (this.#inflate[kLength] > this.#maxDecompressedSize) {
73+
if (this.#inflate[kLength] > kDefaultMaxDecompressedSize) {
7974
this.#aborted = true
8075
this.#inflate.removeAllListeners()
8176
this.#inflate.destroy()

‎lib/web/websocket/receiver.js‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -39,23 +39,18 @@ class ByteParser extends Writable {
3939
/** @type {import('./websocket').Handler} */
4040
#handler
4141

42-
/** @type {{ maxDecompressedMessageSize?: number }} */
43-
#options
44-
4542
/**
4643
* @param {import('./websocket').Handler} handler
4744
* @param {Map<string, string>|null} extensions
48-
* @param {{ maxDecompressedMessageSize?: number }} [options]
4945
*/
50-
constructor (handler, extensions, options = {}) {
46+
constructor (handler, extensions) {
5147
super()
5248

5349
this.#handler = handler
5450
this.#extensions = extensions == null ? new Map() : extensions
55-
this.#options = options
5651

5752
if (this.#extensions.has('permessage-deflate')) {
58-
this.#extensions.set('permessage-deflate', new PerMessageDeflate(extensions, options))
53+
this.#extensions.set('permessage-deflate', new PerMessageDeflate(extensions))
5954
}
6055
}
6156

‎lib/web/websocket/websocket.js‎

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,6 @@ class WebSocket extends EventTarget {
109109
#binaryType
110110
/** @type {import('./receiver').ByteParser} */
111111
#parser
112-
/** @type {{ maxDecompressedMessageSize?: number }} */
113-
#options
114112

115113
/**
116114
* @param {string} url
@@ -156,11 +154,6 @@ class WebSocket extends EventTarget {
156154
// 5. Set this's url to urlRecord.
157155
this.#url = new URL(urlRecord.href)
158156

159-
// Store options for later use (e.g., maxDecompressedMessageSize)
160-
this.#options = {
161-
maxDecompressedMessageSize: options.maxDecompressedMessageSize
162-
}
163-
164157
// 6. Let client be this's relevant settings object.
165158
const client = environmentSettingsObject.settingsObject
166159

@@ -463,7 +456,7 @@ class WebSocket extends EventTarget {
463456
// once this happens, the connection is open
464457
this.#handler.socket = response.socket
465458

466-
const parser = new ByteParser(this.#handler, parsedExtensions, this.#options)
459+
const parser = new ByteParser(this.#handler, parsedExtensions)
467460
parser.on('drain', () => this.#handler.onParserDrain())
468461
parser.on('error', (err) => this.#handler.onParserError(err))
469462

@@ -715,19 +708,6 @@ webidl.converters.WebSocketInit = webidl.dictionaryConverter([
715708
{
716709
key: 'headers',
717710
converter: webidl.nullableConverter(webidl.converters.HeadersInit)
718-
},
719-
{
720-
key: 'maxDecompressedMessageSize',
721-
converter: webidl.nullableConverter((V) => {
722-
V = webidl.converters['unsigned long long'](V)
723-
if (V <= 0) {
724-
throw webidl.errors.exception({
725-
header: 'WebSocket constructor',
726-
message: 'maxDecompressedMessageSize must be greater than 0'
727-
})
728-
}
729-
return V
730-
})
731711
}
732712
])
733713

0 commit comments

Comments
 (0)