dotnet / dotnet/aspnetcore

Reject duplicate 'target' properties in SignalR hub protocol

Open
#68,756 2 comments 0 reactions 0 assignees View on GitHub
area-signalr
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

The JsonHubProtocol doesn't check whether it has already seen the 'target' property, this means it might deserialize the 'arguments' for one 'target' but try to invoke a different 'target'. We should check for duplicate properties and reject the message.
https://github.com/dotnet/aspnetcore/blob/9e6f35811b1129c6ec8b7b15fb0507dfe3a66c90/src/SignalR/common/Protocols.Json/src/Protocol/JsonHubProtocol.cs#L192

While in this area, we should check if other properties should be checked for duplication as well, and check the other protocol implementations (messagepack, newtonsoft, typescript client, etc.)

Contributor guide

Open the contributing guide

Research direction

Start in src/SignalR/common/Protocols.Json/src/Protocol/JsonHubProtocol.cs around line 192 and inspect the existing parsing tests. Trace how target and arguments are read, then compare the MessagePack, Newtonsoft, and TypeScript client protocol implementations mentioned in the issue. Done means duplicate properties are consistently rejected and the relevant protocol tests cover the behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, json, typescript
Domain
backend-api-design, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.