Added a maximum buffer size to received data from polling. Settable with the maxHttpBufferSize option

Author: Tony Kovanen

Diff for: README.md

@@ -193,6 +193,9 @@ to a single process.
         consider the connection closed (`60000`)
       - `pingInterval` (`Number`): how many ms before sending a new ping
         packet (`25000`)
+      - `maxHttpBufferSize` (`Number`): how many bytes or characters a message
+        can be when polling, before closing the session (to avoid DoS). Default
+        value is `10E7`.
       - `transports` (`<Array> String`): transports to allow connections
         to (`['polling', 'websocket', 'flashsocket']`)
       - `allowUpgrades` (`Boolean`): whether to allow transport upgrades

Diff for: lib/server.js

@@ -35,6 +35,7 @@ function Server(opts){
   this.pingTimeout = opts.pingTimeout || 60000;
   this.pingInterval = opts.pingInterval || 25000;
   this.upgradeTimeout = opts.upgradeTimeout || 10000;
+  this.maxHttpBufferSize = opts.maxHttpBufferSize || 10E7;
   this.transports = opts.transports || Object.keys(transports);
   this.allowUpgrades = false !== opts.allowUpgrades;
   this.cookie = false !== opts.cookie ? (opts.cookie || 'io') : false;
@@ -208,8 +209,13 @@ Server.prototype.handshake = function(transport, req){
 
   debug('handshaking client "%s"', id);
 
+  var transportName = transport;
   try {
     var transport = new transports[transport](req);
+    if ('polling' == transportName) {
+      transport.maxHttpBufferSize = this.maxHttpBufferSize;
+    }
+
     if (req.query && req.query.b64) {
       transport.supportsBinary = false;
     } else {

Diff for: lib/transports/polling.js

@@ -139,10 +139,18 @@ Polling.prototype.onDataRequest = function (req, res) {
   }
 
   function onData (data) {
+    var contentLength;
     if (typeof data == 'string') {
       chunks += data;
+      contentLength = Buffer.byteLength(chunks);
     } else {
       chunks = Buffer.concat([chunks, data]);
+      contentLength = chunks.length;
+    }
+
+    if (contentLength > self.maxHttpBufferSize) {
+      chunks = '';
+      req.connection.destroy();
     }
   }
 

Diff for: test/server.js

@@ -792,6 +792,8 @@ describe('server', function () {
   });
 
   describe('messages', function () {
+    this.timeout(5000);
+
     it('should arrive from server to client', function (done) {
       var engine = listen({ allowUpgrades: false }, function (port) {
         var socket = new eioc.Socket('ws://localhost:%d'.s(port));
@@ -844,6 +846,39 @@ describe('server', function () {
       });
     });
 
+    it('should not be receiving data when getting a message longer than maxHttpBufferSize when polling', function(done) {
+      var opts = { allowUpgrades: false, transports: ['polling'], maxHttpBufferSize: 5 };
+      var engine = listen(opts, function (port) {
+        var socket = new eioc.Socket('ws://localhost:%d'.s(port));
+        engine.on('connection', function (conn) {
+          conn.on('message', function(msg) {
+            console.log(msg);
+          });
+        });
+        socket.on('open', function () {
+          socket.send('aasdasdakjhasdkjhasdkjhasdkjhasdkjhasdkjhasdkjha');
+        });
+      });
+      setTimeout(done, 1000);
+    });
+
+    it('should receive data when getting a message shorter than maxHttpBufferSize when polling', function(done) {
+      var opts = { allowUpgrades: false, transports: ['polling'], maxHttpBufferSize: 5 };
+      var engine = listen(opts, function (port) {
+        var socket = new eioc.Socket('ws://localhost:%d'.s(port));
+        engine.on('connection', function (conn) {
+          conn.on('message', function(msg) {
+            expect(msg).to.be('a');
+            done();
+          });
+        });
+        socket.on('open', function () {
+          socket.send('a');
+        });
+      });
+    });
+
+
     it('should arrive from server to client (ws)', function (done) {
       var opts = { allowUpgrades: false, transports: ['websocket'] };
       var engine = listen(opts, function (port) {
@@ -999,7 +1034,7 @@ describe('server', function () {
       var opts = { allowUpgrades: false, transports: ['websocket'] };
       var engine = listen(opts, function(port) {
         var socket = new eioc.Socket('ws://localhost:%d'.s(port), { transports: ['websocket'] });
-        
+
         engine.on('connection', function (conn) {
           conn.send(binaryData);
         });