fix(browser): report malformed relay CDP frames

qingminglong · qingminglong · commit ae2425f414fd · 2026-07-08T14:36:43.000+08:00
diff --git a/extensions/browser/src/browser/extension-relay/relay-bridge.test.ts b/extensions/browser/src/browser/extension-relay/relay-bridge.test.ts
@@ -324,6 +324,34 @@ describe("ExtensionRelayBridge", () => {
     expect(bridge.extensionConnected).toBe(false);
   });
 
+  it("reports malformed CDP client JSON instead of leaving the client waiting", () => {
+    const bridge = new ExtensionRelayBridge();
+    const client = new FakeSocket();
+    const cdp = bridge.attachCdpClientSocket(client);
+
+    cdp.onMessage("{");
+
+    expect(client.frames()).toEqual([
+      { id: null, error: { code: -32700, message: "Parse error" } },
+    ]);
+  });
+
+  it("reports invalid CDP client requests instead of leaving the client waiting", () => {
+    const bridge = new ExtensionRelayBridge();
+    const client = new FakeSocket();
+    const cdp = bridge.attachCdpClientSocket(client);
+
+    cdp.onMessage(JSON.stringify({ id: 7, sessionId: "session-1", params: {} }));
+
+    expect(client.frames()).toEqual([
+      {
+        id: 7,
+        sessionId: "session-1",
+        error: { code: -32600, message: "Invalid request" },
+      },
+    ]);
+  });
+
   it("reaps child sessions when a tab leaves the group (no stale routing)", async () => {
     const bridge = new ExtensionRelayBridge();
     const { handlers } = wireExtension(bridge);
diff --git a/extensions/browser/src/browser/extension-relay/relay-bridge.ts b/extensions/browser/src/browser/extension-relay/relay-bridge.ts
@@ -41,6 +41,10 @@ type CdpRequest = {
   sessionId?: string;
 };
 
+type CdpRequestParseResult =
+  | { ok: true; request: CdpRequest }
+  | { ok: false; id: number | null; sessionId?: string; message: string; code: number };
+
 type PendingExtensionCommand = {
   resolve: (result: unknown) => void;
   reject: (err: Error) => void;
@@ -74,10 +78,37 @@ type ExtensionIdentity = {
   extensionVersion: string;
 };
 
-function toErrorPayload(id: number, sessionId: string | undefined, message: string, code = -32000) {
+function toErrorPayload(
+  id: number | null,
+  sessionId: string | undefined,
+  message: string,
+  code = -32000,
+) {
   return JSON.stringify({ id, ...(sessionId ? { sessionId } : {}), error: { code, message } });
 }
 
+function parseCdpRequest(raw: string): CdpRequestParseResult {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { ok: false, id: null, message: "Parse error", code: -32700 };
+  }
+
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return { ok: false, id: null, message: "Invalid request", code: -32600 };
+  }
+
+  const request = parsed as Record<string, unknown>;
+  const id = typeof request.id === "number" ? request.id : null;
+  const sessionId = typeof request.sessionId === "string" ? request.sessionId : undefined;
+  if (typeof request.id !== "number" || typeof request.method !== "string") {
+    return { ok: false, id, sessionId, message: "Invalid request", code: -32600 };
+  }
+
+  return { ok: true, request: parsed as CdpRequest };
+}
+
 /**
  * One relay bridge per extension-driver profile. Accepts at most one extension
  * connection (a newer one replaces the old — MV3 workers restart freely) and
@@ -494,16 +525,14 @@ export class ExtensionRelayBridge {
     const client: CdpClientState = { socket, autoAttach: false, announcedSessions: new Set() };
     this.clients.add(client);
     const onMessage = (raw: string) => {
-      let request: CdpRequest;
-      try {
-        request = JSON.parse(raw) as CdpRequest;
-      } catch {
-        return;
-      }
-      if (typeof request?.id !== "number" || typeof request?.method !== "string") {
+      const parsed = parseCdpRequest(raw);
+      if (!parsed.ok) {
+        client.socket.send(
+          toErrorPayload(parsed.id, parsed.sessionId, parsed.message, parsed.code),
+        );
         return;
       }
-      void this.handleCdpRequest(client, request);
+      void this.handleCdpRequest(client, parsed.request);
     };
     const onClose = () => {
       this.clients.delete(client);
