Skip to content

Commit c643da0

Browse files
vzaidmanmeta-codesync[bot]
authored andcommitted
Add headers validation check to prevent crash (facebook#55749)
Summary: Pull Request resolved: facebook#55749 Add defensive checks when processing custom headers to ensure: 1. Header keys are valid NSString instances before using them 2. Header values are successfully converted before adding to the request This prevents potential crashes when invalid header data (non-string keys or values that fail conversion) is passed from JavaScript to the WebSocket module. Changelog: [Internal] Differential Revision: D94375533
1 parent 6048a5c commit c643da0

File tree

1 file changed

+31
-2
lines changed

1 file changed

+31
-2
lines changed

packages/react-native/React/CoreModules/RCTWebSocketModule.mm

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -94,8 +94,37 @@ - (void)invalidate
9494
// Load supplied headers
9595
if ([options.headers() isKindOfClass:NSDictionary.class]) {
9696
NSDictionary *headers = (NSDictionary *)options.headers();
97-
[headers enumerateKeysAndObjectsUsingBlock:^(NSString *key, id value, BOOL *stop) {
98-
[request addValue:[RCTConvert NSString:value] forHTTPHeaderField:key];
97+
[headers enumerateKeysAndObjectsUsingBlock:^(id key, id value, BOOL *stop) {
98+
NSString *headerKey = [RCTConvert NSString:key];
99+
NSString *headerValue = [RCTConvert NSString:value];
100+
101+
if (headerKey == nil && headerValue == nil) {
102+
RCTLogError(
103+
@"RCTWebSocketModule: Invalid header key and value types. "
104+
"Expected NSString for both, got key of type %@ and value of type %@.",
105+
NSStringFromClass([key class]),
106+
NSStringFromClass([value class]));
107+
return;
108+
}
109+
110+
if (headerKey == nil) {
111+
RCTLogError(
112+
@"RCTWebSocketModule: Invalid header key type for value '%@'. "
113+
"Expected NSString, got %@.",
114+
value,
115+
NSStringFromClass([key class]));
116+
return;
117+
}
118+
119+
if (headerValue == nil) {
120+
RCTLogError(
121+
@"RCTWebSocketModule: Invalid header value type for key '%@'. "
122+
"Expected NSString, got %@.",
123+
key,
124+
NSStringFromClass([value class]));
125+
}
126+
127+
[request addValue:headerValue == nil ? @"" : headerValue forHTTPHeaderField:key];
99128
}];
100129
}
101130

0 commit comments

Comments
 (0)