jcreek/CosmicClash
1
0
Fork 0
mirror of https://github.com/jcreek/CosmicClash.git synced 2026-09-11 08:23:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(multiplayer): harden websocket frame parser

Browse Source
This commit is contained in:
Josh Creek
2026-09-01 21:23:20 +01:00
parent 3eb47bb9d3
commit 30a22c366b
3 changed files with 28 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/api/events.go
+8 -1
View File
@@ -317,6 +317,10 @@ func readWebSocketFrame(reader *bufio.Reader) (byte, []byte, error) {
if first&0x70 != 0 || first&0x80 == 0 {
return 0, nil, errors.New("unsupported websocket frame")
}
opcode := first & 0x0f
if opcode != 0x8 && opcode != 0x9 && opcode != 0xA {
return 0, nil, errors.New("unsupported websocket opcode")
}
if second&0x80 == 0 {
return 0, nil, errors.New("unmasked websocket frame")
}
@@ -337,6 +341,9 @@ func readWebSocketFrame(reader *bufio.Reader) (byte, []byte, error) {
if length > maxWebSocketFrame {
return 0, nil, errors.New("websocket frame too large")
}
if opcode&0x8 != 0 && length > 125 {
return 0, nil, errors.New("websocket control frame too large")
}
var mask [4]byte
if _, err := io.ReadFull(reader, mask[:]); err != nil {
return 0, nil, err
@@ -348,7 +355,7 @@ func readWebSocketFrame(reader *bufio.Reader) (byte, []byte, error) {
for i := range payload {
payload[i] ^= mask[i%4]
}
return first & 0x0f, payload, nil
return opcode, payload, nil
}
func writeWebSocketFrame(connection net.Conn, opcode byte, payload []byte) error {