Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: socketio/engine.io
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: 6.1.0
Choose a base ref
...
head repository: socketio/engine.io
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: 6.1.1
Choose a head ref
  • 3 commits
  • 7 files changed
  • 2 contributors

Commits on Dec 14, 2021

  1. refactor: import Node's setTimeout & clearTimeout to prevent ambiguity ( 

    #632)
    @JeffWinder
    JeffWinder authored Dec 14, 2021
    Configuration menu
    Copy the full SHA
    b04967b View commit details
    Browse the repository at this point in the history

Commits on Jan 11, 2022

  1. fix: properly handle invalid data sent by a malicious websocket client 

    **IMPORTANT SECURITY FIX**

A malicious client could send a specially crafted HTTP request,
triggering an uncaught exception and killing the Node.js process:

> RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear
>   at Receiver.getInfo (/.../node_modules/ws/lib/receiver.js:176:14)
>   at Receiver.startLoop (/.../node_modules/ws/lib/receiver.js:136:22)
>   at Receiver._write (/.../node_modules/ws/lib/receiver.js:83:10)
>   at writeOrBuffer (internal/streams/writable.js:358:12)

This bug was introduced by [1], included in `engine.io@4.0.0`, so
previous releases are not impacted.

[1]: f3c291f

Thanks to Marcus Wejderot from Mevisio for the responsible disclosure.
    @darrachequesne
    darrachequesne committed Jan 11, 2022
    Configuration menu
    Copy the full SHA
    c0e194d View commit details
    Browse the repository at this point in the history

  2. chore(release): 6.1.1 

    Diff: 6.1.0...6.1.1
    @darrachequesne
    darrachequesne committed Jan 11, 2022
    Configuration menu
    Copy the full SHA
    f3b761d View commit details
    Browse the repository at this point in the history
Loading