Reject duplicate 'target' properties in SignalR hub protocol
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 281
Description
The JsonHubProtocol doesn't check whether it has already seen the 'target' property, this means it might deserialize the 'arguments' for one 'target' but try to invoke a different 'target'. We should check for duplicate properties and reject the message.
https://github.com/dotnet/aspnetcore/blob/9e6f35811b1129c6ec8b7b15fb0507dfe3a66c90/src/SignalR/common/Protocols.Json/src/Protocol/JsonHubProtocol.cs#L192
While in this area, we should check if other properties should be checked for duplication as well, and check the other protocol implementations (messagepack, newtonsoft, typescript client, etc.)
Contributor guide
Research direction
Start in src/SignalR/common/Protocols.Json/src/Protocol/JsonHubProtocol.cs around line 192 and inspect the existing parsing tests. Trace how target and arguments are read, then compare the MessagePack, Newtonsoft, and TypeScript client protocol implementations mentioned in the issue. Done means duplicate properties are consistently rejected and the relevant protocol tests cover the behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, json, typescript
- Domain
- backend-api-design, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100