test (2)

Author: darrachequesne

packages/socket.io-parser/lib/index.ts

@@ -139,7 +139,7 @@ type JSONReviver = (this: any, key: string, value: any) => any;
 
 export interface DecoderOptions {
   /**
-   * Custom reviver to pass down to JSON.stringify()
+   * Custom reviver to pass down to JSON.parse()
    */
   reviver?: JSONReviver;
   /**
@@ -160,15 +160,16 @@ export class Decoder extends Emitter<{}, {}, DecoderReservedEvents> {
 
   /**
    * Decoder constructor
-   *
-   * @param {function|DecoderOptions} opts - custom reviver to pass down to JSON.stringify or an options object
    */
   constructor(opts?: DecoderOptions | JSONReviver) {
     super();
-    this.opts = Object.assign({
-      reviver: undefined,
-      maxAttachments: 3
-    }, typeof opts === "function" ? { reviver: opts } : opts);
+    this.opts = Object.assign(
+      {
+        reviver: undefined,
+        maxAttachments: 3,
+      },
+      typeof opts === "function" ? { reviver: opts } : opts,
+    );
   }
 
   /**
@@ -244,7 +245,9 @@ export class Decoder extends Emitter<{}, {}, DecoderReservedEvents> {
         throw new Error("Illegal attachments");
       }
       p.attachments = Number(buf);
-      if (p.attachments > this.opts.maxAttachments) {
+      if (!isInteger(p.attachments) || p.attachments < 0) {
+        throw new Error("Illegal attachments");
+      } else if (p.attachments > this.opts.maxAttachments) {
         throw new Error("too many attachments");
       }
     }

packages/socket.io-parser/test/parser.js

@@ -171,6 +171,16 @@ describe("socket.io-parser", () => {
     isInvalidPayload('2["connect"]');
     isInvalidPayload('2["disconnect","123"]');
 
+    const isInvalidAttachmentCount = (str) =>
+      expect(() => new Decoder().add(str)).to.throwException(
+        /^Illegal attachments$/,
+      );
+
+    isInvalidAttachmentCount("5");
+    isInvalidAttachmentCount("51");
+    isInvalidAttachmentCount("5a-");
+    isInvalidAttachmentCount("51.23-");
+
     expect(() => new Decoder().add("999")).to.throwException(
       /^unknown packet type 9$/,
     );