Repository: nodejs/node
Pull request: inspector: fix crash when receiving non json message

I fixed an issue where Node.js would crash if a WebSocket client sent a non-JSON message while the Inspector was open, like in the following example:
``` js
const socket = new WebSocket('ws://127.0.0.1:9229/e9817809-7f12-450b-ae45-e1fe9be416f4');

socket.addEventListener('open', (event) => {
    socket.send('Hello Server!');
});
```
Sorry, this issue was due to a mistake in the implementation of the following change.
https://github.com/nodejs/node/pull/56759
<!--
Before submitting a pull request, please read:

- the CONTRIBUTING guide at https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md
- the commit message formatting guidelines at
  https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#commit-message-guidelines

For code changes:
1. Include tests for any bug fixes or new features.
2. Update documentation if relevant.
3. Ensure that `make -j4 test` (UNIX), or `vcbuild test` (Windows) passes.

If you believe this PR should be highlighted in the Node.js CHANGELOG
please add the `notable-change` label.

Developer's Certificate of Origin 1.1

By making a contribution to this project, I certify that:

(a) The contribution was created in whole or in part by me and I
    have the right to submit it under the open source license
    indicated in the file; or

(b) The contribution is based upon previous work that, to the best
    of my knowledge, is covered under an appropriate open source
    license and I have the right under that license to submit that
    work with modifications, whether created in whole or in part
    by me, under the same open source license (unless I am
    permitted to submit under a different license), as indicated
    in the file; or

(c) The contribution was provided directly to me by some other
    person who certified (a), (b) or (c) and I have not modified
    it.

(d) I understand and agree that this project and the contribution
    are public and that a record of the contribution (including all
    personal information I submit with it, including my sign-off) is
    maintained indefinitely and may be redistributed consistent with
    this project or the open source license(s) involved.
-->


Changed files:
filename: src/inspector_io.cc
patch: @@ -353,6 +353,9 @@ std::optional<std::string> InspectorIoDelegate::GetTargetSessionId(
   std::string_view view(message.data(), message.size());
   std::unique_ptr<protocol::DictionaryValue> value =
       protocol::DictionaryValue::cast(JsonUtil::parseJSON(view));
+  if (!value) {
+    return std::nullopt;
+  }
   protocol::String target_session_id;
   protocol::Value* target_session_id_value = value->get("sessionId");
   if (target_session_id_value) {

filename: test/parallel/test-inspector-invalid-protocol.js
patch: @@ -0,0 +1,40 @@
+'use strict';
+const common = require('../common');
+common.skipIfInspectorDisabled();
+const { spawn } = require('node:child_process');
+const assert = require('node:assert');
+
+(async () => {
+  const child = spawn(
+    process.execPath,
+    ['--inspect-wait=0', '-e', "console.log('test');"],
+    {}
+  );
+
+  const url = await new Promise((resolve) => {
+    child.stderr.on('data', (data) => {
+      const msg = data.toString();
+      const match = msg.match(/ws:\/\/127\.0\.0\.1:(\d+)\/([a-f0-9-]+)/);
+      if (match) {
+        child.stderr.removeAllListeners('data');
+        return resolve(match[0]);
+      }
+    });
+  });
+
+  child.once('exit', (_, signal) => {
+    assert.strictEqual(signal, 'SIGTERM');
+  });
+
+  const socket = new WebSocket(url);
+
+  socket.addEventListener('open', common.mustCall(() => {
+    socket.send('This is not a valid protocol message');
+  }));
+
+  socket.addEventListener('message', common.mustCall((event) => {
+    assert.ok(Object.keys(JSON.parse(event.data)).includes('error'));
+    socket.close();
+    child.kill();
+  }));
+})().then(common.mustCall());