websockets / ws / 9535036224

100%

push

github

[security] Fix crash when the Upgrade header cannot be read (#2231)

It is possible that the Upgrade header is correctly received and handled
(the `'upgrade'` event is emitted) without its value being returned to
the user. This can happen if the number of received headers exceed the
`server.maxHeadersCount` or `request.maxHeadersCount` threshold. In this
case `incomingMessage.headers.upgrade` may not be set.

Handle the case correctly and abort the handshake.

Fixes #2230

1074 of 1078 branches covered (99.63%)

5 of 5 new or added lines in 2 files covered. (100.0%)

1557 of 1558 relevant lines covered (99.94%)

26269.06 hits per line