websockets / ws / 26280863463 / 31

100%

master: 100%

push

github

[security] Limit retained message parts

Previously, the receiver could retain one `Buffer` entry per buffered
chunk or message fragment until enough data was parsed or the message
completed. A peer could use many tiny fragments/chunks and make retained
memory scale with retained part count rather than message payload size.

Add configurable `maxBufferedChunks` and `maxFragments` options to bound
the number of retained parts. When either limit is exceeded, emit
a `WS_ERR_TOO_MANY_BUFFERED_PARTS` error and close the connection with
close code 1008.

Signed-off-by: Nadav0077 <18245584+Nadav0077@users.noreply.github.com>

1123 of 1133 branches covered (99.12%)

1651 of 1657 relevant lines covered (99.64%)

903.57 hits per line