fojas / cleverbot-node

Cleverbot client in node.js
MIT License
62 stars 33 forks source link

Unexpected end of JSON input #37

Closed Wodki closed 7 years ago

Wodki commented 7 years ago
SyntaxError: Unexpected end of JSON input
    at Object.parse (native)
    at Object.<anonymous> (../node_modules/cleverbot-node/lib/cleverbot.js:55:35)
    at emitNone (events.js:91:20)
    at IncomingMessage.emit (events.js:185:7)
    at endReadableNT (_stream_readable.js:974:12)
    at _combinedTickCallback (internal/process/next_tick.js:74:11)
    at process._tickDomainCallback [as _tickCallback] (internal/process/next_tick.js:122:9)

I have the latest celeverbot version and I call the cleverbot simply by using the example code

const Cleverbot = require('cleverbot-node');
var cleverbot = new Cleverbot;

cleverbot.configure({botapi: "..."});
cleverbot.write(msg == '' ? 'hi' : msg, function (response) {
  msg.reply(response.message);
});

Before I get this error I have noticed cleverbot takes more time to answer progressively and eventually leading to this error.

fojas commented 7 years ago

I reverted some code that should handle the bad chars in the response. There appears to be some issues with escape chars in JSON responses that I need to figure out. The fix I put in place is dirty, but it should work.

Wodki commented 7 years ago

Indeed the fix is kind of dirty, as a matter of fact I had applied almost the same fix in my celverbot.js, nonetheless thank you

fojas commented 7 years ago

@Wodki Do you mind sharing what your fix was? I am not satisfied with this because I think there is a possibility of crafting a request that would enable remote code execution. I would hate to see something like FOO\"} , console.log(1), {"bar":" trigger something unexpected. I wasn't able to build a string that would cause the cleverbot API to return a malicious string, but there are smarter people than I that could possibly do it.

Wodki commented 7 years ago

Sorry for being away the past few days but you didnt really miss anything. I too had used an eval, but a module, not the native cause it seems at least to me a bit unsafe and I tend to avoid it, eval's in general.