diff --git a/src/socket.io/index.js b/src/socket.io/index.js index 60c7a8cd27..30e4e23581 100644 --- a/src/socket.io/index.js +++ b/src/socket.io/index.js @@ -120,7 +120,12 @@ async function onMessage(socket, payload) { return winston.warn('[socket.io] Empty method name'); } - const parts = eventName.toString().split('.'); + if (typeof eventName !== 'string') { + const escapedName = validator.escape(String(eventName)); + return callback({ message: `[[error:invalid-event, ${escapedName}]]` }); + } + + const parts = eventName.split('.'); const namespace = parts[0]; const methodToCall = parts.reduce((prev, cur) => { if (prev !== null && prev[cur] && (!prev.hasOwnProperty || prev.hasOwnProperty(cur))) { diff --git a/test/socket.io.js b/test/socket.io.js index 1a94a38f7c..333a9cea97 100644 --- a/test/socket.io.js +++ b/test/socket.io.js @@ -107,6 +107,15 @@ describe('socket.io', () => { }); }); + it('should return error for invalid eventName type', (done) => { + const eventName = ['topics.loadMoreTags']; + io.emit(eventName, function (err) { + const eventAsString = String(eventName); + assert.strictEqual(err.message, `[[error:invalid-event, ${eventAsString}]]`); + done(); + }); + }); + it('should get installed themes', (done) => { const themes = ['nodebb-theme-lavender', 'nodebb-theme-persona', 'nodebb-theme-vanilla']; io.emit('admin.themes.getInstalled', (err, data) => {