fix: message with a missing or non-string socketId

Signed-off-by: Mark Tolmacs <mark@lazycat.hu>

excalidraw-app/collab/Collab.tsx

@@ -113,6 +113,10 @@ export const userToFollowAtom = atom<UserToFollow | null>(null);
 
 type CollabInstance = InstanceType<typeof Collab>;
 
+/** remote payloads are untrusted, so validate the socketId before use */
+const isValidSocketId = (socketId: unknown): socketId is SocketId =>
+  typeof socketId === "string" && socketId.length > 0;
+
 export interface CollabAPI {
   /** function so that we can access the latest value from stale callbacks */
   isCollaborating: () => boolean;
@@ -626,6 +630,10 @@ class Collab extends PureComponent<CollabProps, CollabState> {
               // @ts-ignore legacy, see #2094 (#2097)
               decryptedData.payload.socketID;
 
+            if (!isValidSocketId(socketId)) {
+              return;
+            }
+
             this.updateCollaborator(socketId, {
               pointer,
               button,
@@ -639,6 +647,10 @@ class Collab extends PureComponent<CollabProps, CollabState> {
           case WS_SUBTYPES.USER_VISIBLE_SCENE_BOUNDS: {
             const { sceneBounds, socketId } = decryptedData.payload;
 
+            if (!isValidSocketId(socketId)) {
+              return;
+            }
+
             const userToFollow = appJotaiStore.get(userToFollowAtom);
 
             // we're not following the user
@@ -670,6 +682,11 @@ class Collab extends PureComponent<CollabProps, CollabState> {
 
           case WS_SUBTYPES.IDLE_STATUS: {
             const { userState, socketId, username } = decryptedData.payload;
+
+            if (!isValidSocketId(socketId)) {
+              return;
+            }
+
             this.updateCollaborator(socketId, {
               userState,
               username: typeof username === "string" ? username : null,

packages/excalidraw/clients.ts

@@ -16,7 +16,8 @@ import type {
 
 function hashToInteger(id: string) {
   let hash = 0;
-  if (id.length === 0) {
+  // guard against non-string ids coming from untrusted collaborator data
+  if (typeof id !== "string" || id.length === 0) {
     return hash;
   }
   for (let i = 0; i < id.length; i++) {

packages/excalidraw/tests/clients.test.ts

@@ -1,4 +1,24 @@
-import { getNameInitial } from "../clients";
+import { getClientColor, getNameInitial } from "../clients";
+
+import type { SocketId } from "../types";
+
+describe("getClientColor", () => {
+  it("returns a stable color for string ids", () => {
+    expect(getClientColor("abc" as SocketId, undefined)).toBe(
+      "hsl(60, 100%, 83%)",
+    );
+  });
+
+  it("does not throw for non-string ids", () => {
+    const fallback = getClientColor("" as SocketId, undefined);
+    for (const id of [null, undefined, 42, ["a"], { length: 1 }, {}]) {
+      expect(getClientColor(id as any, undefined)).toBe(fallback);
+      expect(() =>
+        getClientColor("abc" as SocketId, { id: id as any }),
+      ).not.toThrow();
+    }
+  });
+});
 
 describe("getClientInitials", () => {
   it("returns substring if one name provided", () => {