removed serialization, was a security risk

This commit is contained in:
nitowa
2023-01-10 06:33:25 +01:00
parent ec158e6090
commit c138a2b9af
5 changed files with 7 additions and 205 deletions
+2 -124
View File
@@ -1,5 +1,4 @@
import { describe, it } from "mocha";
import { RPCServer, RPCSocket, Serializable } from '../Index'
import { RPCExporter, Socket } from "../src/Interfaces";
import { ConnectedSocket, Callback, GenericFunction } from "../src/Types";
import * as log from 'why-is-node-running';
@@ -10,6 +9,7 @@ import { PromiseIO } from "../src/PromiseIO/Server";
import { PromiseIOClient } from "../src/PromiseIO/Client";
import { assert, expect } from 'chai';
import { CLASSNAME_ATTRIBUTE, USER_DEFINED_TIMEOUT } from "../src/Strings";
import { RPCServer, RPCSocket } from "../Index";
var should = require('chai').should();
var chai = require("chai");
var chaiAsPromised = require("chai-as-promised");
@@ -1010,126 +1010,4 @@ describe("attaching handlers before connecting", () => {
done(e)
})
})
})
describe("class (de-)serialization", () => {
@Serializable()
class SubClass {
fString = "F"
}
@Serializable()
class TestClass {
aString = "A"
aNumber = 46
aObject = {
x: "x",
y: undefined,
sub: new SubClass()
}
aClassObject = new SubClass()
public returnOK() {
return "OK"
}
}
const verifyObject = (obj: any) => {
expect(obj).to.be.an.instanceOf(TestClass)
expect(obj.aString).to.be.a('string')
expect(obj.aNumber).to.be.a('number')
expect(obj.aObject).to.be.a('object')
expect(obj.aObject.x).to.be.a('string')
expect(obj.aObject.y).to.be.undefined
expect(obj.aObject.sub).to.be.an.instanceOf(SubClass)
expect(obj.aClassObject).to.be.an.instanceOf(SubClass)
expect(obj).to.not.have.key(CLASSNAME_ATTRIBUTE)
expect(obj.aObject.sub).to.not.have.key(CLASSNAME_ATTRIBUTE)
expect(obj.aClassObject).to.not.have.key(CLASSNAME_ATTRIBUTE)
expect(obj.returnOK()).to.be.equal('OK')
}
describe("Responses", () => {
type TestIfc = {
Test: {
returnClass: () => Promise<TestClass>
classCallback: (callback: Callback<[TestClass]>) => Promise<TestClass>
}
}
let myServer: RPCServer<TestIfc>;
let mySocket: ConnectedSocket<TestIfc>;
before(function (done) {
myServer = new RPCServer<TestIfc>([{
name: "Test",
RPCs: [
async function returnClass() {
return new TestClass()
}, {
name: "classCallback",
hook: async function (callback) {
setTimeout(_ => callback(new TestClass()), 250)
return new TestClass()
}
}
]
}])
myServer.listen(8084)
new RPCSocket<TestIfc>(8084, 'localhost').connect().then(connsock => {
mySocket = connsock
done()
})
})
after(function (done) {
mySocket.close()
myServer.close()
done()
})
it("receives class object in call response", async () => {
const obj: TestClass = await mySocket['Test'].returnClass()
verifyObject(obj)
})
it("receives class object in hook response", async function () {
const obj: TestClass = await mySocket.Test.classCallback(function(x){
x
})
verifyObject(obj)
})
it("receives class object in callback", function (done) {
mySocket.Test.classCallback(function (cbValue) {
verifyObject(cbValue)
done()
}).then(verifyObject)
})
})
describe("Parameters", () => {
it("Class object in call", function(done){
const server = new RPCServer([
{
name: "Test",
RPCs: [
function callWithClass(testObj: TestClass){
verifyObject(testObj)
done()
}
]
}
]).listen(8086)
new RPCSocket(8086, 'localhost').connect().then(sock => {
sock['Test'].callWithClass(new TestClass()).then(_ => {
sock.close()
server.close()
})
})
})
})
})
})