Run npm install

node_modules/ws/lib/websocket-server.js

@@ -1,14 +1,24 @@
+/* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^net|tls|https$" }] */
+
 'use strict';
 
 const EventEmitter = require('events');
-const crypto = require('crypto');
 const http = require('http');
-const url = require('url');
+const https = require('https');
+const net = require('net');
+const tls = require('tls');
+const { createHash } = require('crypto');
 
 const PerMessageDeflate = require('./permessage-deflate');
-const extension = require('./extension');
-const constants = require('./constants');
 const WebSocket = require('./websocket');
+const { format, parse } = require('./extension');
+const { GUID, kWebSocket } = require('./constants');
+
+const keyRegex = /^[+/0-9A-Za-z]{22}==$/;
+
+const RUNNING = 0;
+const CLOSING = 1;
+const CLOSED = 2;
 
 /**
  * Class representing a WebSocket server.
@@ -20,22 +30,28 @@ class WebSocketServer extends EventEmitter {
    * Create a `WebSocketServer` instance.
    *
    * @param {Object} options Configuration options
-   * @param {String} options.host The hostname where to bind the server
-   * @param {Number} options.port The port where to bind the server
-   * @param {http.Server} options.server A pre-created HTTP/S server to use
-   * @param {Function} options.verifyClient An hook to reject connections
-   * @param {Function} options.handleProtocols An hook to handle protocols
-   * @param {String} options.path Accept only connections matching this path
-   * @param {Boolean} options.noServer Enable no server mode
-   * @param {Boolean} options.clientTracking Specifies whether or not to track clients
-   * @param {(Boolean|Object)} options.perMessageDeflate Enable/disable permessage-deflate
-   * @param {Number} options.maxPayload The maximum allowed message size
-   * @param {Function} callback A listener for the `listening` event
+   * @param {Number} [options.backlog=511] The maximum length of the queue of
+   *     pending connections
+   * @param {Boolean} [options.clientTracking=true] Specifies whether or not to
+   *     track clients
+   * @param {Function} [options.handleProtocols] A hook to handle protocols
+   * @param {String} [options.host] The hostname where to bind the server
+   * @param {Number} [options.maxPayload=104857600] The maximum allowed message
+   *     size
+   * @param {Boolean} [options.noServer=false] Enable no server mode
+   * @param {String} [options.path] Accept only connections matching this path
+   * @param {(Boolean|Object)} [options.perMessageDeflate=false] Enable/disable
+   *     permessage-deflate
+   * @param {Number} [options.port] The port where to bind the server
+   * @param {(http.Server|https.Server)} [options.server] A pre-created HTTP/S
+   *     server to use
+   * @param {Function} [options.verifyClient] A hook to reject connections
+   * @param {Function} [callback] A listener for the `listening` event
    */
-  constructor (options, callback) {
+  constructor(options, callback) {
     super();
 
-    options = Object.assign({
+    options = {
       maxPayload: 100 * 1024 * 1024,
       perMessageDeflate: false,
       handleProtocols: null,
@@ -46,12 +62,18 @@ class WebSocketServer extends EventEmitter {
       server: null,
       host: null,
       path: null,
-      port: null
-    }, options);
+      port: null,
+      ...options
+    };
 
-    if (options.port == null && !options.server && !options.noServer) {
+    if (
+      (options.port == null && !options.server && !options.noServer) ||
+      (options.port != null && (options.server || options.noServer)) ||
+      (options.server && options.noServer)
+    ) {
       throw new TypeError(
-        'One of the "port", "server", or "noServer" options must be specified'
+        'One and only one of the "port", "server", or "noServer" options ' +
+          'must be specified'
       );
     }
 
@@ -65,19 +87,24 @@ class WebSocketServer extends EventEmitter {
         });
         res.end(body);
       });
-      this._server.listen(options.port, options.host, options.backlog, callback);
+      this._server.listen(
+        options.port,
+        options.host,
+        options.backlog,
+        callback
+      );
     } else if (options.server) {
       this._server = options.server;
     }
 
     if (this._server) {
+      const emitConnection = this.emit.bind(this, 'connection');
+
       this._removeListeners = addListeners(this._server, {
         listening: this.emit.bind(this, 'listening'),
         error: this.emit.bind(this, 'error'),
         upgrade: (req, socket, head) => {
-          this.handleUpgrade(req, socket, head, (ws) => {
-            this.emit('connection', ws, req);
-          });
+          this.handleUpgrade(req, socket, head, emitConnection);
         }
       });
     }
@@ -85,6 +112,7 @@ class WebSocketServer extends EventEmitter {
     if (options.perMessageDeflate === true) options.perMessageDeflate = {};
     if (options.clientTracking) this.clients = new Set();
     this.options = options;
+    this._state = RUNNING;
   }
 
   /**
@@ -96,7 +124,7 @@ class WebSocketServer extends EventEmitter {
    * @return {(Object|String|null)} The address of the server
    * @public
    */
-  address () {
+  address() {
     if (this.options.noServer) {
       throw new Error('The server is operating in "noServer" mode');
     }
@@ -108,10 +136,20 @@ class WebSocketServer extends EventEmitter {
   /**
    * Close the server.
    *
-   * @param {Function} cb Callback
+   * @param {Function} [cb] Callback
    * @public
    */
-  close (cb) {
+  close(cb) {
+    if (cb) this.once('close', cb);
+
+    if (this._state === CLOSED) {
+      process.nextTick(emitClose, this);
+      return;
+    }
+
+    if (this._state === CLOSING) return;
+    this._state = CLOSING;
+
     //
     // Terminate all associated clients.
     //
@@ -128,10 +166,13 @@ class WebSocketServer extends EventEmitter {
       //
       // Close the http server if it was internally created.
       //
-      if (this.options.port != null) return server.close(cb);
+      if (this.options.port != null) {
+        server.close(emitClose.bind(undefined, this));
+        return;
+      }
     }
 
-    if (cb) cb();
+    process.nextTick(emitClose, this);
   }
 
   /**
@@ -141,9 +182,12 @@ class WebSocketServer extends EventEmitter {
    * @return {Boolean} `true` if the request is valid, else `false`
    * @public
    */
-  shouldHandle (req) {
-    if (this.options.path && url.parse(req.url).pathname !== this.options.path) {
-      return false;
+  shouldHandle(req) {
+    if (this.options.path) {
+      const index = req.url.indexOf('?');
+      const pathname = index !== -1 ? req.url.slice(0, index) : req.url;
+
+      if (pathname !== this.options.path) return false;
     }
 
     return true;
@@ -153,22 +197,30 @@ class WebSocketServer extends EventEmitter {
    * Handle a HTTP Upgrade request.
    *
    * @param {http.IncomingMessage} req The request object
-   * @param {net.Socket} socket The network socket between the server and client
+   * @param {(net.Socket|tls.Socket)} socket The network socket between the
+   *     server and client
    * @param {Buffer} head The first packet of the upgraded stream
    * @param {Function} cb Callback
    * @public
    */
-  handleUpgrade (req, socket, head, cb) {
+  handleUpgrade(req, socket, head, cb) {
     socket.on('error', socketOnError);
 
+    const key =
+      req.headers['sec-websocket-key'] !== undefined
+        ? req.headers['sec-websocket-key'].trim()
+        : false;
     const upgrade = req.headers.upgrade;
     const version = +req.headers['sec-websocket-version'];
     const extensions = {};
 
     if (
-      req.method !== 'GET' || upgrade === undefined ||
+      req.method !== 'GET' ||
+      upgrade === undefined ||
       upgrade.toLowerCase() !== 'websocket' ||
-      !req.headers['sec-websocket-key'] || (version !== 8 && version !== 13) ||
+      !key ||
+      !keyRegex.test(key) ||
+      (version !== 8 && version !== 13) ||
       !this.shouldHandle(req)
     ) {
       return abortHandshake(socket, 400);
@@ -182,9 +234,7 @@ class WebSocketServer extends EventEmitter {
       );
 
       try {
-        const offers = extension.parse(
-          req.headers['sec-websocket-extensions']
-        );
+        const offers = parse(req.headers['sec-websocket-extensions']);
 
         if (offers[PerMessageDeflate.extensionName]) {
           perMessageDeflate.accept(offers[PerMessageDeflate.extensionName]);
@@ -200,8 +250,9 @@ class WebSocketServer extends EventEmitter {
     //
     if (this.options.verifyClient) {
       const info = {
-        origin: req.headers[`${version === 8 ? 'sec-websocket-origin' : 'origin'}`],
-        secure: !!(req.connection.authorized || req.connection.encrypted),
+        origin:
+          req.headers[`${version === 8 ? 'sec-websocket-origin' : 'origin'}`],
+        secure: !!(req.socket.authorized || req.socket.encrypted),
         req
       };
 
@@ -211,7 +262,7 @@ class WebSocketServer extends EventEmitter {
             return abortHandshake(socket, code || 401, message, headers);
           }
 
-          this.completeUpgrade(extensions, req, socket, head, cb);
+          this.completeUpgrade(key, extensions, req, socket, head, cb);
         });
         return;
       }
@@ -219,38 +270,50 @@ class WebSocketServer extends EventEmitter {
       if (!this.options.verifyClient(info)) return abortHandshake(socket, 401);
     }
 
-    this.completeUpgrade(extensions, req, socket, head, cb);
+    this.completeUpgrade(key, extensions, req, socket, head, cb);
   }
 
   /**
    * Upgrade the connection to WebSocket.
    *
+   * @param {String} key The value of the `Sec-WebSocket-Key` header
    * @param {Object} extensions The accepted extensions
    * @param {http.IncomingMessage} req The request object
-   * @param {net.Socket} socket The network socket between the server and client
+   * @param {(net.Socket|tls.Socket)} socket The network socket between the
+   *     server and client
    * @param {Buffer} head The first packet of the upgraded stream
    * @param {Function} cb Callback
+   * @throws {Error} If called more than once with the same socket
    * @private
    */
-  completeUpgrade (extensions, req, socket, head, cb) {
+  completeUpgrade(key, extensions, req, socket, head, cb) {
     //
     // Destroy the socket if the client has already sent a FIN packet.
     //
     if (!socket.readable || !socket.writable) return socket.destroy();
 
-    const key = crypto.createHash('sha1')
-      .update(req.headers['sec-websocket-key'] + constants.GUID, 'binary')
+    if (socket[kWebSocket]) {
+      throw new Error(
+        'server.handleUpgrade() was called more than once with the same ' +
+          'socket, possibly due to a misconfiguration'
+      );
+    }
+
+    if (this._state > RUNNING) return abortHandshake(socket, 503);
+
+    const digest = createHash('sha1')
+      .update(key + GUID)
       .digest('base64');
 
     const headers = [
       'HTTP/1.1 101 Switching Protocols',
       'Upgrade: websocket',
       'Connection: Upgrade',
-      `Sec-WebSocket-Accept: ${key}`
+      `Sec-WebSocket-Accept: ${digest}`
     ];
 
     const ws = new WebSocket(null);
-    var protocol = req.headers['sec-websocket-protocol'];
+    let protocol = req.headers['sec-websocket-protocol'];
 
     if (protocol) {
       protocol = protocol.split(',').map(trim);
@@ -266,13 +329,13 @@ class WebSocketServer extends EventEmitter {
 
       if (protocol) {
         headers.push(`Sec-WebSocket-Protocol: ${protocol}`);
-        ws.protocol = protocol;
+        ws._protocol = protocol;
       }
     }
 
     if (extensions[PerMessageDeflate.extensionName]) {
       const params = extensions[PerMessageDeflate.extensionName].params;
-      const value = extension.format({
+      const value = format({
         [PerMessageDeflate.extensionName]: [params]
       });
       headers.push(`Sec-WebSocket-Extensions: ${value}`);
@@ -294,7 +357,7 @@ class WebSocketServer extends EventEmitter {
       ws.on('close', () => this.clients.delete(ws));
     }
 
-    cb(ws);
+    cb(ws, req);
   }
 }
 
@@ -306,51 +369,66 @@ module.exports = WebSocketServer;
  *
  * @param {EventEmitter} server The event emitter
  * @param {Object.<String, Function>} map The listeners to add
- * @return {Function} A function that will remove the added listeners when called
+ * @return {Function} A function that will remove the added listeners when
+ *     called
  * @private
  */
-function addListeners (server, map) {
+function addListeners(server, map) {
   for (const event of Object.keys(map)) server.on(event, map[event]);
 
-  return function removeListeners () {
+  return function removeListeners() {
     for (const event of Object.keys(map)) {
       server.removeListener(event, map[event]);
     }
   };
 }
 
+/**
+ * Emit a `'close'` event on an `EventEmitter`.
+ *
+ * @param {EventEmitter} server The event emitter
+ * @private
+ */
+function emitClose(server) {
+  server._state = CLOSED;
+  server.emit('close');
+}
+
 /**
  * Handle premature socket errors.
  *
  * @private
  */
-function socketOnError () {
+function socketOnError() {
   this.destroy();
 }
 
 /**
  * Close the connection when preconditions are not fulfilled.
  *
- * @param {net.Socket} socket The socket of the upgrade request
+ * @param {(net.Socket|tls.Socket)} socket The socket of the upgrade request
  * @param {Number} code The HTTP response status code
  * @param {String} [message] The HTTP response body
  * @param {Object} [headers] Additional HTTP response headers
  * @private
  */
-function abortHandshake (socket, code, message, headers) {
+function abortHandshake(socket, code, message, headers) {
   if (socket.writable) {
     message = message || http.STATUS_CODES[code];
-    headers = Object.assign({
-      'Connection': 'close',
-      'Content-type': 'text/html',
-      'Content-Length': Buffer.byteLength(message)
-    }, headers);
+    headers = {
+      Connection: 'close',
+      'Content-Type': 'text/html',
+      'Content-Length': Buffer.byteLength(message),
+      ...headers
+    };
 
     socket.write(
       `HTTP/1.1 ${code} ${http.STATUS_CODES[code]}\r\n` +
-      Object.keys(headers).map(h => `${h}: ${headers[h]}`).join('\r\n') +
-      '\r\n\r\n' +
-      message
+        Object.keys(headers)
+          .map((h) => `${h}: ${headers[h]}`)
+          .join('\r\n') +
+        '\r\n\r\n' +
+        message
     );
   }
 
@@ -366,6 +444,6 @@ function abortHandshake (socket, code, message, headers) {
  *     characters from both its beginning and end
  * @private
  */
-function trim (str) {
+function trim(str) {
   return str.trim();
 }