fix(browser): report malformed relay CDP frames (#102070)

qingminglong · steipete · web-flow · commit 56096eb8590c · 2026-07-09T12:00:38.000+01:00
* fix(browser): report malformed relay CDP frames

* refactor(browser): streamline relay frame validation

---------

Co-authored-by: Peter Steinberger &lt;steipete@gmail.com&gt;
diff --git a/extensions/browser/src/browser/extension-relay/relay-bridge.test.ts b/extensions/browser/src/browser/extension-relay/relay-bridge.test.ts
@@ -324,6 +324,34 @@ describe("ExtensionRelayBridge", () => {
     expect(bridge.extensionConnected).toBe(false);
   });
 
+  it("reports malformed CDP client JSON instead of leaving the client waiting", () => {
+    const bridge = new ExtensionRelayBridge();
+    const client = new FakeSocket();
+    const cdp = bridge.attachCdpClientSocket(client);
+
+    cdp.onMessage("{");
+
+    expect(client.frames()).toEqual([
+      { id: null, error: { code: -32700, message: "Parse error" } },
+    ]);
+  });
+
+  it("reports invalid CDP client requests instead of leaving the client waiting", () => {
+    const bridge = new ExtensionRelayBridge();
+    const client = new FakeSocket();
+    const cdp = bridge.attachCdpClientSocket(client);
+
+    cdp.onMessage(JSON.stringify({ id: 7, sessionId: "session-1", params: {} }));
+
+    expect(client.frames()).toEqual([
+      {
+        id: 7,
+        sessionId: "session-1",
+        error: { code: -32600, message: "Invalid request" },
+      },
+    ]);
+  });
+
   it("reaps child sessions when a tab leaves the group (no stale routing)", async () => {
     const bridge = new ExtensionRelayBridge();
     const { handlers } = wireExtension(bridge);
diff --git a/extensions/browser/src/browser/extension-relay/relay-bridge.ts b/extensions/browser/src/browser/extension-relay/relay-bridge.ts
@@ -74,7 +74,12 @@ type ExtensionIdentity = {
   extensionVersion: string;
 };
 
-function toErrorPayload(id: number, sessionId: string | undefined, message: string, code = -32000) {
+function toErrorPayload(
+  id: number | null,
+  sessionId: string | undefined,
+  message: string,
+  code = -32000,
+): string {
   return JSON.stringify({ id, ...(sessionId ? { sessionId } : {}), error: { code, message } });
 }
 
@@ -494,16 +499,26 @@ export class ExtensionRelayBridge {
     const client: CdpClientState = { socket, autoAttach: false, announcedSessions: new Set() };
     this.clients.add(client);
     const onMessage = (raw: string) => {
-      let request: CdpRequest;
+      let parsed: unknown;
       try {
-        request = JSON.parse(raw) as CdpRequest;
+        parsed = JSON.parse(raw);
       } catch {
+        client.socket.send(toErrorPayload(null, undefined, "Parse error", -32700));
         return;
       }
-      if (typeof request?.id !== "number" || typeof request?.method !== "string") {
+      if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        client.socket.send(toErrorPayload(null, undefined, "Invalid request", -32600));
         return;
       }
-      void this.handleCdpRequest(client, request);
+      const request = parsed as Record<string, unknown>;
+      if (typeof request.id !== "number" || typeof request.method !== "string") {
+        const id = typeof request.id === "number" ? request.id : null;
+        const sessionId = typeof request.sessionId === "string" ? request.sessionId : undefined;
+        // Flat CDP routes responses by sessionId before matching the request id.
+        client.socket.send(toErrorPayload(id, sessionId, "Invalid request", -32600));
+        return;
+      }
+      void this.handleCdpRequest(client, request as CdpRequest);
     };
     const onClose = () => {
       this.clients.delete(client);
