From 5736345440e43ac7f8d72c748c6b959bee5f8aa8 Mon Sep 17 00:00:00 2001 From: Egor Tensin Date: Sat, 14 Mar 2026 12:19:48 +0100 Subject: wait, what the hell? doesn't Dependabot update node_modules as well? --- node_modules/undici/lib/web/websocket/util.js | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'node_modules/undici/lib/web/websocket/util.js') diff --git a/node_modules/undici/lib/web/websocket/util.js b/node_modules/undici/lib/web/websocket/util.js index e5ce789..2a04887 100644 --- a/node_modules/undici/lib/web/websocket/util.js +++ b/node_modules/undici/lib/web/websocket/util.js @@ -266,6 +266,12 @@ function parseExtensions (extensions) { * @param {string} value */ function isValidClientWindowBits (value) { + // Must have at least one character + if (value.length === 0) { + return false + } + + // Check all characters are ASCII digits for (let i = 0; i < value.length; i++) { const byte = value.charCodeAt(i) @@ -274,7 +280,9 @@ function isValidClientWindowBits (value) { } } - return true + // Check numeric range: zlib requires windowBits in range 8-15 + const num = Number.parseInt(value, 10) + return num >= 8 && num <= 15 } // https://nodejs.org/api/intl.html#detecting-internationalization-support -- cgit v1.3