Dangerous: Sending binary message cause sending source code of backend instead

ghost commented 3 years ago

As in title, sending binary message cause sending fragments of your source code in that binary message instead.

I'm using latest engine.io backend with eiows and tested with classic ws also. And eiows seems to has a bug in sending binary.

When you send binary message to client, like this in your backend code:

socket.send(Buffer.from([0, 1, 2, 3, 4, 5]));

You will receive in chrome browser:

for eiows: 8.2kb binary message, when you inspect it more you will see fragments of your source code in it :O - dangerous bug
for ws: 6B binary message - correct

mmdevries commented 3 years ago

Thanks for creating this ticket to report the issue. I think the problem is introduced in version 3.6.0. The problem should now be solved in version 3.6.1.

ghost commented 3 years ago

Yes, works great. That was quick fix. Thanks!

mmdevries commented 3 years ago

Nice, thanks for the feedback. I will close the issue.

mmdevries / eiows

Dangerous: Sending binary message cause sending source code of backend instead #8

When you send binary message to client, like this in your backend code:

You will receive in chrome browser: