websockets / ws / 9534899047 / 22

100%

master: 100%

Pull #2231

github

[security] Fix crash when the Upgrade header cannot be read

It is possible that the Upgrade header is correctly received and handled
(the `'upgrade'` event is emitted) without its value being returned to
the user. This can happen if the number of received headers exceed the
`server.maxHeadersCount` or `request.maxHeadersCount` threshold. In this
case `incomingMessage.headers.upgrade` may not be set.

Handle the case correctly and abort the handshake.

Fixes #2230

1070 of 1078 branches covered (99.26%)

1552 of 1558 relevant lines covered (99.61%)

908.48 hits per line