Fixing CVE-2023-32695 on 3.3.x

index.js

@@ -268,6 +268,26 @@ Decoder.prototype.add = function(obj) {
   }
 };
 
+function isPayloadValid(type, payload) {
+  switch (type) {
+    case 0: // CONNECT
+      return typeof payload === "object";
+    case 1: // DISCONNECT
+      return payload === undefined;
+    case 4: // ERROR
+      return typeof payload === "string" || typeof payload === "object";
+    case 2: // EVENT
+    case 5: // BINARY_EVENT
+      return (
+        isArray(payload) &&
+        (typeof payload[0] === "string" || typeof payload[0] === "number")
+      );
+    case 3: // ACK
+    case 6: // BINARY_ACK
+      return isArray(payload);
+  }
+}
+
 /**
  * Decode a packet String (JSON data)
  *
@@ -329,11 +349,10 @@ function decodeString(str) {
   // look up json data
   if (str.charAt(++i)) {
     var payload = tryParse(str.substr(i));
-    var isPayloadValid = payload !== false && (p.type === exports.ERROR || isArray(payload));
-    if (isPayloadValid) {
+    if (isPayloadValid(p.type, payload)) {
       p.data = payload;
     } else {
-      return error('invalid payload');
+      throw new Error("invalid payload");
     }
   }
 

test/arraybuffer.js

@@ -50,7 +50,7 @@ describe('parser', function() {
   it('cleans itself up on close', function() {
     var packet = {
       type: parser.BINARY_EVENT,
-      data: [new ArrayBuffer(2), new ArrayBuffer(3)],
+      data: ["foo", new ArrayBuffer(2), new ArrayBuffer(3)],
       id: 0,
       nsp: '/'
     };

test/parser.js

@@ -86,12 +86,20 @@ describe('parser', function(){
     }
   });
 
-  it('returns an error packet on parsing error', function(done){
-    var decoder = new parser.Decoder();
-    decoder.on('decoded', function(packet) {
-      expect(packet).to.eql({ type: 4, data: 'parser error: invalid payload' });
-      done();
-    });
-    decoder.add('442["some","data"');
+  it('returns an error packet on parsing error', function(){
+    function isInvalidPayload (str) {
+      expect(function () {
+        new parser.Decoder().add(str)
+      }).to.throwException(/^invalid payload$/);
+    }
+
+    isInvalidPayload('442["some","data"');
+    isInvalidPayload('0/admin,"invalid"');
+    isInvalidPayload("1/admin,{}");
+    isInvalidPayload('2/admin,"invalid');
+    isInvalidPayload("2/admin,{}");
+    isInvalidPayload('2[{"toString":"foo"}]');
+    isInvalidPayload('2[true,"foo"]');
+    isInvalidPayload('2[null,"bar"]');
   });
 });