Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle unsubscription safer while client closes #454

Merged
merged 4 commits into from Mar 3, 2020

Conversation

gnought
Copy link
Collaborator

@gnought gnought commented Feb 26, 2020

We're better not to inject a custom key close into one of argument in handleUnSubscribe fn. Malicious unsubscribe packet may break aedes unsubscribe logic.

Copy link
Member

@robertsLando robertsLando left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Copy link
Collaborator

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add tests

@gnought
Copy link
Collaborator Author

gnought commented Feb 26, 2020

@mcollina we already cover it in

aedes/test/meta.js

Lines 184 to 204 in 209efd0

test('dont emit unsubscribe event on client close', function (t) {
t.plan(3)
const broker = aedes()
t.tearDown(broker.close.bind(broker))
const s = noError(connect(setup(broker), { clientId: 'abcde' }), t)
broker.on('unsubscribe', function (unsubscriptions, client) {
t.error('unsubscribe should not be emitted')
})
subscribe(t, s, 'hello', 0, function () {
s.inStream.end({
cmd: 'disconnect'
})
s.outStream.once('data', function (packet) {
t.pass('unsubscribe completed')
})
})
})

@robertsLando
Copy link
Member

@gnought I think he means a test where a malicious packet with close prop is received

Copy link
Member

@robertsLando robertsLando left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@gnought
Copy link
Collaborator Author

gnought commented Mar 3, 2020

ping @mcollina

Copy link
Collaborator

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

Copy link
Collaborator

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@gnought gnought merged commit 05d2ee3 into moscajs:master Mar 3, 2020
@gnought gnought deleted the feature/safe_unsubscribe branch March 3, 2020 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants