From 8944bf4a17800bb5ebf3cfc6ccff04db381f4902 Mon Sep 17 00:00:00 2001
From: Mark Tolmacs <mark@lazycat.hu>
Date: Thu, 24 Sep 2026 14:16:16 +0200
Subject: [PATCH] fix: message with a missing or non-string socketId

Signed-off-by: Mark Tolmacs <mark@lazycat.hu>
---
 excalidraw-app/collab/Collab.tsx          | 17 +++++++++++++++++
 packages/excalidraw/clients.ts            |  3 ++-
 packages/excalidraw/tests/clients.test.ts | 22 +++++++++++++++++++++-
 3 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/excalidraw-app/collab/Collab.tsx b/excalidraw-app/collab/Collab.tsx
index cb6fccfe2e..eeb7291a11 100644
--- a/excalidraw-app/collab/Collab.tsx
+++ b/excalidraw-app/collab/Collab.tsx
@@ -113,6 +113,10 @@ export const userToFollowAtom = atom<UserToFollow | null>(null);
 
 type CollabInstance = InstanceType<typeof Collab>;
 
+/** remote payloads are untrusted, so validate the socketId before use */
+const isValidSocketId = (socketId: unknown): socketId is SocketId =>
+  typeof socketId === "string" && socketId.length > 0;
+
 export interface CollabAPI {
   /** function so that we can access the latest value from stale callbacks */
   isCollaborating: () => boolean;
@@ -626,6 +630,10 @@ class Collab extends PureComponent<CollabProps, CollabState> {
               // @ts-ignore legacy, see #2094 (#2097)
               decryptedData.payload.socketID;
 
+            if (!isValidSocketId(socketId)) {
+              return;
+            }
+
             this.updateCollaborator(socketId, {
               pointer,
               button,
@@ -639,6 +647,10 @@ class Collab extends PureComponent<CollabProps, CollabState> {
           case WS_SUBTYPES.USER_VISIBLE_SCENE_BOUNDS: {
             const { sceneBounds, socketId } = decryptedData.payload;
 
+            if (!isValidSocketId(socketId)) {
+              return;
+            }
+
             const userToFollow = appJotaiStore.get(userToFollowAtom);
 
             // we're not following the user
@@ -670,6 +682,11 @@ class Collab extends PureComponent<CollabProps, CollabState> {
 
           case WS_SUBTYPES.IDLE_STATUS: {
             const { userState, socketId, username } = decryptedData.payload;
+
+            if (!isValidSocketId(socketId)) {
+              return;
+            }
+
             this.updateCollaborator(socketId, {
               userState,
               username: typeof username === "string" ? username : null,
diff --git a/packages/excalidraw/clients.ts b/packages/excalidraw/clients.ts
index 1d4b8a235c..357d832fca 100644
--- a/packages/excalidraw/clients.ts
+++ b/packages/excalidraw/clients.ts
@@ -16,7 +16,8 @@ import type {
 
 function hashToInteger(id: string) {
   let hash = 0;
-  if (id.length === 0) {
+  // guard against non-string ids coming from untrusted collaborator data
+  if (typeof id !== "string" || id.length === 0) {
     return hash;
   }
   for (let i = 0; i < id.length; i++) {
diff --git a/packages/excalidraw/tests/clients.test.ts b/packages/excalidraw/tests/clients.test.ts
index 79ef8a675b..86bd6560fa 100644
--- a/packages/excalidraw/tests/clients.test.ts
+++ b/packages/excalidraw/tests/clients.test.ts
@@ -1,4 +1,24 @@
-import { getNameInitial } from "../clients";
+import { getClientColor, getNameInitial } from "../clients";
+
+import type { SocketId } from "../types";
+
+describe("getClientColor", () => {
+  it("returns a stable color for string ids", () => {
+    expect(getClientColor("abc" as SocketId, undefined)).toBe(
+      "hsl(60, 100%, 83%)",
+    );
+  });
+
+  it("does not throw for non-string ids", () => {
+    const fallback = getClientColor("" as SocketId, undefined);
+    for (const id of [null, undefined, 42, ["a"], { length: 1 }, {}]) {
+      expect(getClientColor(id as any, undefined)).toBe(fallback);
+      expect(() =>
+        getClientColor("abc" as SocketId, { id: id as any }),
+      ).not.toThrow();
+    }
+  });
+});
 
 describe("getClientInitials", () => {
   it("returns substring if one name provided", () => {