Vulnerability: ReDoS in Sec-Websocket-Protocol header ### Impact

A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.

### Proof of concept

```js
for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}
```

### Patches

The vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff) and backported to ws@6.2.2 (https://github.com/websockets/ws/commit/78c676d2a1acefbc05292e9f7ea0a9457704bf1b) and ws@5.2.3 (https://github.com/websockets/ws/commit/76d47c1479002022a3e4357b3c9f0e23a68d4cd2).

### Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

### Credits

The vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.
Vulnerability ID: GHSA-6fc8-4gx4-v693
CWE: CWE-400
Severity score: 5.3
Project: https://github.com/websockets/ws
Published: 2021-05-28
File: lib/websocket-server.js
Commit message: [security] Fix ReDoS vulnerability

A specially crafted value of the `Sec-Websocket-Protocol` header could
be used to significantly slow down a ws server.

PoC and fix were sent privately by Robert McLaughlin from University of
California, Santa Barbara.
Commit author: Luigi Pinca

Vulnerable version (before fix):
 class WebSocketServer extends EventEmitter {     let protocol = req.headers['sec-websocket-protocol'];      if (protocol) {       protocol = protocol.trim().split(/ *, */);        //       // Optionally call external protocol selection handler. function abortHandshake(socket, code, message, headers) {   socket.removeListener('error', socketOnError);   socket.destroy(); }

Fixed version (after fix):
 class WebSocketServer extends EventEmitter {     let protocol = req.headers['sec-websocket-protocol'];      if (protocol) {       protocol = protocol.split(',').map(trim);        //       // Optionally call external protocol selection handler. function abortHandshake(socket, code, message, headers) {   socket.removeListener('error', socketOnError);   socket.destroy(); }  /**  * Remove whitespace characters from both ends of a string.  *  * @param {String} str The string  * @return {String} A new string representing `str` stripped of whitespace  *     characters from both its beginning and end  * @private  */ function trim(str) {   return str.trim(); }

Patch:
patch: @@ -286,7 +286,7 @@ class WebSocketServer extends EventEmitter {
     let protocol = req.headers['sec-websocket-protocol'];
 
     if (protocol) {
-      protocol = protocol.trim().split(/ *, */);
+      protocol = protocol.split(',').map(trim);
 
       //
       // Optionally call external protocol selection handler.
@@ -404,3 +404,15 @@ function abortHandshake(socket, code, message, headers) {
   socket.removeListener('error', socketOnError);
   socket.destroy();
 }
+
+/**
+ * Remove whitespace characters from both ends of a string.
+ *
+ * @param {String} str The string
+ * @return {String} A new string representing `str` stripped of whitespace
+ *     characters from both its beginning and end
+ * @private
+ */
+function trim(str) {
+  return str.trim();
+}
path: lib/websocket-server.js