Skip to content

Commit 4ff1d2e

Browse files
vzaidmanmeta-codesync[bot]
authored andcommitted
Add headers validation check to prevent crash (facebook#55749)
Summary: Pull Request resolved: facebook#55749 Add defensive checks when processing custom headers to ensure: 1. Header keys are valid NSString instances before using them 2. Header values are successfully converted before adding to the request This prevents potential crashes when invalid header data (non-string keys or values that fail conversion) is passed from JavaScript to the WebSocket module. Changelog: [Internal] Differential Revision: D94375533
1 parent 328981e commit 4ff1d2e

File tree

1 file changed

+32
-2
lines changed

1 file changed

+32
-2
lines changed

packages/react-native/React/CoreModules/RCTWebSocketModule.mm

Lines changed: 32 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,8 +96,38 @@ - (void)invalidate
9696
// Load supplied headers
9797
if ([options.headers() isKindOfClass:NSDictionary.class]) {
9898
NSDictionary *headers = (NSDictionary *)options.headers();
99-
[headers enumerateKeysAndObjectsUsingBlock:^(NSString *key, id value, BOOL *stop) {
100-
[request addValue:[RCTConvert NSString:value] forHTTPHeaderField:key];
99+
[headers enumerateKeysAndObjectsUsingBlock:^(id key, id value, BOOL *stop) {
100+
BOOL validKey = [key isKindOfClass:[NSString class]];
101+
BOOL validValue = [value isKindOfClass:[NSString class]];
102+
103+
if (!validKey && !validValue) {
104+
RCTLogError(
105+
@"RCTWebSocketModule: Invalid header key and value types. "
106+
"Expected NSString for both, got key of type %@ and value of type %@.",
107+
NSStringFromClass([key class]),
108+
NSStringFromClass([value class]));
109+
return;
110+
}
111+
112+
if (!validKey) {
113+
RCTLogError(
114+
@"RCTWebSocketModule: Invalid header key type for value '%@'. "
115+
"Expected NSString, got %@.",
116+
value,
117+
NSStringFromClass([key class]));
118+
return;
119+
}
120+
121+
if (!validValue) {
122+
RCTLogError(
123+
@"RCTWebSocketModule: Invalid header value type for key '%@'. "
124+
"Expected NSString, got %@.",
125+
key,
126+
NSStringFromClass([value class]));
127+
}
128+
129+
NSString *headerValue = validValue ? [RCTConvert NSString:value] : @"";
130+
[request addValue:headerValue forHTTPHeaderField:key];
101131
}];
102132
}
103133

0 commit comments

Comments
 (0)