Harden JSON-RPC 2.0 message handling - #7
Open
minrbook wants to merge 6 commits into
Open
Conversation
added 6 commits
July 30, 2026 14:21
Success paths already deleted the deferred after resolve, but error responses only rejected the Promise and left the slot in place. On a long-lived WebSocket each failed call retained resolve/reject closures indefinitely. Delete the entry after reject, matching resolve, and add a regression test.
Reject non-2.0 jsonrpc, non-string methods, and non-structured params with -32600. Surface Invalid Request for top-level null/primitives instead of silently dropping them. Require responses to carry exactly one of result or error, and match pending call ids by value and type via Map (number 1 !== string "1"). Update batch response fixtures and add protocol regression tests.
Reject non-object error payloads and errors without an integer code or string message without settling or freeing waiting calls. Use Object.prototype.hasOwnProperty.call for all property checks so inputs cannot override hasOwnProperty. Store pending ids with a typeof-prefixed key on an Object.create(null) map so number/string ids never collide without depending on Map. Always report Invalid Request with id null. Rebuild minified dist with compress.arrows disabled to keep ES5-compatible output for older browsers.
Require response id to be a string, number, or null via isValidRequestId so boolean/object/array ids are treated as invalid responses and never settle pending calls. Return a single Invalid Request (id null) for empty batch arrays per JSON-RPC 2.0. Centralize console.log capture/restore in tests so failed assertions cannot leave a patched logger for later cases.
minrbook
changed the title
minrbook
marked this pull request as ready for review
July 30, 2026 08:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Invalid Requestfor primitive messages and empty batchesWhy
Several error paths did not follow JSON-RPC 2.0 semantics. Notifications could produce error responses, rejected calls remained in
waitingframefor the lifetime of a connection, and malformed messages could be executed or settle unrelated pending calls.The updated resolver validates the message shape before classifying it, uses safe own-property checks, and stores pending calls under typed keys. Invalid responses are ignored without settling their matching call, while valid success and error responses both release their pending slot.
Validation
hasOwnProperty, and empty batchesThank you for creating and maintaining this lightweight JSON-RPC library. I hope these protocol-compliance and reliability improvements are useful to the project.