diff --git a/packages/engine.io/lib/userver.ts b/packages/engine.io/lib/userver.ts index 6cef789bc..bbbb04d8a 100644 --- a/packages/engine.io/lib/userver.ts +++ b/packages/engine.io/lib/userver.ts @@ -185,13 +185,13 @@ export class uServer extends BaseServer { const client = this.clients[id]; if (!client) { debug("upgrade attempt for closed client"); - res.close(); + return res.close(); } else if (client.upgrading) { debug("transport has already been trying to upgrade"); - res.close(); + return res.close(); } else if (client.upgraded) { debug("transport had already been upgraded"); - res.close(); + return res.close(); } else { debug("upgrading existing transport"); transport = this.createTransport(req._query.transport, req); diff --git a/packages/engine.io/test/server.js b/packages/engine.io/test/server.js index 898e53f67..1795b00bb 100644 --- a/packages/engine.io/test/server.js +++ b/packages/engine.io/test/server.js @@ -205,6 +205,26 @@ describe("server", () => { }); }); + it("should prevent the client from upgrading twice", (done) => { + engine = listen((port) => { + const client = new ClientSocket(`ws://localhost:${port}`); + + client.on("upgrade", () => { + const socket = new WebSocket( + `ws://localhost:${port}/engine.io/?EIO=4&transport=websocket&sid=${client.id}`, + ); + + socket.on("error", () => {}); + + socket.on("close", () => { + client.close(); + + done(); + }); + }); + }); + }); + it("should disallow `__proto__` as transport (polling)", (done) => { const partialDone = createPartialDone(done, 2);