debugger: validate sec-websocket-accept response header

lib/internal/debugger/inspect_client.js

@@ -11,6 +11,7 @@ const {
 } = primordials;
 
 const Buffer = require('buffer').Buffer;
+const crypto = require('crypto');
 const { ERR_DEBUGGER_ERROR } = require('internal/errors').codes;
 const { EventEmitter } = require('events');
 const http = require('http');
@@ -35,13 +36,30 @@ const kTwoBytePayloadLengthField = 126;
 const kEightBytePayloadLengthField = 127;
 const kMaskingKeyWidthInBytes = 4;
 
+// This guid is defined in the Websocket Protocol RFC
+// https://tools.ietf.org/html/rfc6455#section-1.3
+const WEBSOCKET_HANDSHAKE_GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';
+
 function unpackError({ code, message, data }) {
   const err = new ERR_DEBUGGER_ERROR(`${message} - ${data}`);
   err.code = code;
   ErrorCaptureStackTrace(err, unpackError);
   return err;
 }
 
+function validateHandshake(requestKey, responseKey) {
+  const expectedResponseKeyBase = requestKey + WEBSOCKET_HANDSHAKE_GUID;
+  const shasum = crypto.createHash('sha1');
+  shasum.update(expectedResponseKeyBase);
+  const shabuf = shasum.digest();
+
+  if (shabuf.toString('base64') !== responseKey) {
+    throw new ERR_DEBUGGER_ERROR(
+      `WebSocket secret mismatch: ${requestKey} did not match ${responseKey}`
+    );
+  }
+}
+
 function encodeFrameHybi17(payload) {
   var i;
 
@@ -287,8 +305,8 @@ class Client extends EventEmitter {
   _connectWebsocket(urlPath) {
     this.reset();
 
-    const key1 = require('crypto').randomBytes(16).toString('base64');
-    debuglog('request websocket', key1);
+    const requestKey = crypto.randomBytes(16).toString('base64');
+    debuglog('request WebSocket', requestKey);
 
     const httpReq = this._http = http.request({
       host: this._host,
@@ -297,7 +315,7 @@ class Client extends EventEmitter {
       headers: {
         'Connection': 'Upgrade',
         'Upgrade': 'websocket',
-        'Sec-WebSocket-Key': key1,
+        'Sec-WebSocket-Key': requestKey,
         'Sec-WebSocket-Version': '13',
       },
     });
@@ -314,7 +332,7 @@ class Client extends EventEmitter {
     });
 
     const handshakeListener = (res, socket) => {
-      // TODO: we *could* validate res.headers[sec-websocket-accept]
+      validateHandshake(requestKey, res.headers['sec-websocket-accept']);
       debuglog('websocket upgrade');
 
       this._socket = socket;

src/node_native_module.cc

@@ -70,6 +70,7 @@ void NativeModuleLoader::InitializeModuleCategories() {
   std::vector<std::string> prefixes = {
 #if !HAVE_OPENSSL
     "internal/crypto/",
+    "internal/debugger/",
 #endif  // !HAVE_OPENSSL
 
     "internal/bootstrap/",

test/parallel/test-debugger-websocket-secret-mismatch.js

@@ -0,0 +1,54 @@
+'use strict';
+
+const common = require('../common');
+common.skipIfInspectorDisabled();
+
+const assert = require('assert');
+const childProcess = require('child_process');
+const http = require('http');
+
+let port;
+
+const server = http.createServer(common.mustCall((req, res) => {
+  if (req.url.startsWith('/json')) {
+    res.writeHead(200);
+    res.end(`[ {
+      "description": "",
+      "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:${port}/devtools/page/DAB7FB6187B554E10B0BD18821265734",
+      "cid": "DAB7FB6187B554E10B0BD18821265734",
+      "title": "Fhqwhgads",
+      "type": "page",
+      "url": "https://www.example.com/",
+      "webSocketDebuggerUrl": "ws://localhost:${port}/devtools/page/DAB7FB6187B554E10B0BD18821265734"
+    } ]`);
+  } else {
+    res.setHeader('Upgrade', 'websocket');
+    res.setHeader('Connection', 'Upgrade');
+    res.setHeader('Sec-WebSocket-Accept', 'fhqwhgads');
+    res.setHeader('Sec-WebSocket-Protocol', 'chat');
+    res.writeHead(101);
+    res.end();
+  }
+}, 2)).listen(0, common.mustCall(() => {
+  port = server.address().port;
+  const proc =
+    childProcess.spawn(process.execPath, ['inspect', `localhost:${port}`]);
+
+  let stdout = '';
+  proc.stdout.on('data', (data) => {
+    stdout += data.toString();
+    assert.doesNotMatch(stdout, /\bok\b/);
+  });
+
+  let stderr = '';
+  proc.stderr.on('data', (data) => {
+    stderr += data.toString();
+  });
+
+  proc.on('exit', common.mustCall((code, signal) => {
+    assert.match(stderr, /\bWebSocket secret mismatch\b/);
+    assert.notStrictEqual(code, 0);
+    assert.strictEqual(signal, null);
+    server.close();
+  }));
+}));