daoqi/youle_cocos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(config): reject WebSocket URL fragments at parse boundary

Browse Source
This commit is contained in:
joywayer
2026-09-05 21:27:29 +08:00
parent 053302c5df
commit 58c974e114
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cocoscreator_projects/YouleNexus/assets/framework/config/remote-config.ts
+1 -1
View File
@@ -69,7 +69,7 @@ function normalizeWebSocketUrl(value: string): string {
} }
try { try {
const parsed = new URL(url); const parsed = new URL(url);
if (!value || /\s/.test(value) || !parsed.hostname || parsed.username || parsed.password if (!value || /\s/.test(value) || url.includes('#') || !parsed.hostname || parsed.username || parsed.password
|| (parsed.protocol !== 'ws:' && parsed.protocol !== 'wss:')) throw new Error('invalid'); || (parsed.protocol !== 'ws:' && parsed.protocol !== 'wss:')) throw new Error('invalid');
} catch { } catch {
throw new ConfigParseError('Invalid remote server: malformed WebSocket URL'); throw new ConfigParseError('Invalid remote server: malformed WebSocket URL');
cocoscreator_projects/framework-tests/config/remote-config.test.ts
+8
View File
@@ -66,3 +66,11 @@ test('missing or invalid chosen servers never fall back to obsolete envelope or
assert.throws(() => api.parseUrlServers(view(raw)), api.ConfigParseError); assert.throws(() => api.parseUrlServers(view(raw)), api.ConfigParseError);
} }
}); });
test('WebSocket fragments including an empty trailing marker fail at the config boundary', () => {
for (const address of ['ws://127.0.0.1:3088/#invalid', 'wss://example.test/#', 'example.test:3088#']) {
assert.throws(() => api.parseUrlServers(view({ player_server_tcp: address })), api.ConfigParseError);
}
assert.deepEqual(api.parseUrlServers(view({ player_server_tcp: 'wss://example.test/path%23part' })),
['wss://example.test/path%23part']);
});