websockets / ws / 26282572948

100%

push

github

[security] Limit retained message parts

Previously, the receiver could retain one `Buffer` entry per buffered
chunk or message fragment until enough data was parsed or the message
completed. A peer could use many tiny fragments/chunks and make retained
memory scale with retained part count rather than message payload size.

Add configurable `maxBufferedChunks` and `maxFragments` options to bound
the number of retained parts. When either limit is exceeded, emit
a `WS_ERR_TOO_MANY_BUFFERED_PARTS` error and close the connection with
close code 1008.

Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>

1128 of 1133 branches covered (99.56%)

13 of 13 new or added lines in 1 file covered. (100.0%)

1656 of 1657 relevant lines covered (99.94%)

30761.97 hits per line