[Security] Bump ws from 1.0.1 to 7.5.3

[dependabot-preview]

Bumps ws from 1.0.1 to 7.5.3. This update includes security fixes.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

High severity vulnerability that affects ws ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.

Affected versions: < 1.1.1

Sourced from The Node Security Working Group.

DoS due to excessively large websocket message ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455"

By sending an overly long websocket payload to a ws server, it is possible to crash the node process.

Affected versions: <=1.1.0

Sourced from The GitHub Security Advisory Database.

Denial of Service in ws Affected versions of ws can crash when a specially crafted Sec-WebSocket-Extensions header containing Object.prototype property names as extension or parameter names is sent.

Proof of concept

const WebSocket = require('ws');
const net = require('net');
const wss = new WebSocket.Server({ port: 3000 }, function () {
const payload = 'constructor';  // or ',;constructor'
const request = [
'GET / HTTP/1.1',
'Connection: Upgrade',
'Sec-WebSocket-Key: test',
'Sec-WebSocket-Version: 8',
Sec-WebSocket-Extensions: ${payload},
'Upgrade: websocket',
'\r\n'
].join('\r\n');
</tr></table>

... (truncated)

Affected versions: >= 0.2.6 < 1.1.5

Sourced from The GitHub Security Advisory Database.

ReDoS in Sec-Websocket-Protocol header

Impact

A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

Proof of concept

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}

Patches

... (truncated)

Affected versions: < 6.2.2

Sourced from The GitHub Security Advisory Database.

ReDoS in Sec-Websocket-Protocol header

Impact

A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server.

Proof of concept

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();
value.trim().split(/ *, */);
const end = process.hrtime.bigint();
console.log('length = %d, time = %f ns', length, end - start);
}

Patches

... (truncated)

Affected versions: < 5.2.3

Release notes

Sourced from ws's releases.

7.5.3

Bug fixes

• The WebSocketServer constructor now throws an error if more than one of the noServer, server, and port options are specefied (66e58d27).
• Fixed a bug where a 'close' event was emitted by a WebSocketServer before the internal HTTP/S server was actually closed (5a587304).
• Fixed a bug that allowed WebSocket connections to be established after WebSocketServer.prototype.close() was called (772236a1).

7.5.2

Bug fixes

• The opening handshake is now aborted if the client receives a Sec-WebSocket-Extensions header but no extension was requested or if the server indicates an extension not requested by the client (aca94c86).

7.5.1

Bug fixes

• Fixed an issue that prevented the connection from being closed properly if an error occurred simultaneously on both peers (b434b9f1).

7.5.0

Features

• Some errors now have a code property describing the specific type of error that has occurred (#1901).

Bug fixes

• A close frame is now sent to the remote peer if an error (such as a data framing error) occurs (8806aa9a).
• The close code is now always 1006 if no close frame is received, even if the connection is closed due to an error (8806aa9a).

7.4.6

Bug fixes

• Fixed a ReDoS vulnerability (00c425ec).

A specially crafted value of the Sec-Websocket-Protocol header could be used to significantly slow down a ws server.

for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();
value.trim().split(/ *, */);
</tr></table>

... (truncated)

Commits

• 4c1849a [dist] 7.5.3
• 772236a [fix] Abort the handshake if the server is closing or closed
• 5a58730 [fix] Emit the 'close' event after the server is closed
• ea63b29 [minor] Fix typo
• 66e58d2 [fix] Make the {noS,s}erver, and port options mutually exclusive
• ecb9d9e [minor] Improve JSDoc-inferred types (#1912)
• 0ad1f9d [dist] 7.5.2
• aca94c8 [fix] Abort the handshake if an unexpected extension is received
• 38c6c73 [dist] 7.5.1
• 2916006 [test] Add more tests for WebSocket.prototype.close()
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by lpinca, a new releaser for ws since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[dependabot-preview]

Superseded by #207.