Browse Source

fix a DoS against websocket clients

I assumed gorilla validated UTF8 for incoming text messages. In fact, the
documentation states:

>It is the application's responsibility to ensure that text messages
>are valid UTF-8 encoded text.

and this applies to both incoming and outgoing messages. Consequently,
even when enforce-utf8 is enabled, it was possible to send invalid UTF8
to Ergo inside a websocket text frame. This data would be incorrectly
considered valid UTF8, and could be relayed to other clients, including
to websocket clients inside a text frame. The resulting frame would violate
the websocket protocol, causing web clients to be disconnected.
tags/v2.11.1
Shivaram Lingamneni 1 year ago
parent
commit
9589d019cb
1 changed files with 2 additions and 2 deletions
  1. 2
    2
      irc/ircconn.go

+ 2
- 2
irc/ircconn.go View File

128
 }
128
 }
129
 
129
 
130
 func (wc IRCWSConn) ReadLine() (line []byte, err error) {
130
 func (wc IRCWSConn) ReadLine() (line []byte, err error) {
131
-	messageType, line, err := wc.conn.ReadMessage()
131
+	_, line, err = wc.conn.ReadMessage()
132
 	if err == nil {
132
 	if err == nil {
133
-		if messageType == websocket.BinaryMessage && !utf8.Valid(line) {
133
+		if !utf8.Valid(line) {
134
 			return line, errInvalidUtf8
134
 			return line, errInvalidUtf8
135
 		}
135
 		}
136
 		return line, nil
136
 		return line, nil

Loading…
Cancel
Save