202401 2019-10-01 06:03:40 -0700 REGRESSION (Safari 13): WebSocket payload is truncated when x-webkit-deflate-frame is used 2019-11-25 00:50:22 -0800 1 1 1 Unclassified WebKit WebCore Misc. Other Mac macOS 10.14 RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=204237 https://bugs.webkit.org/show_bug.cgi?id=198973 InRadar P2 Normal --- 1 volodymyr.sorokin youennf achristensen ap berkus cgarcia commit-queue ews-watchlist fabrizio.ruggeri toyoshim volodymyr.sorokin webkit-bug-importer youennf yutak oldest_to_newest 1575509 0 volodymyr.sorokin 2019-10-01 06:03:40 -0700 Since Safari 13.0 release, webkit starts to truncate websocket's payload to 4092 bytes when 'x-webkit-deflate-frame' extension is used. The issue is fairly easy to reproduce - just send to a websocket any data whose compressed size is 5kb or more. Moreover, the websocket (most likely the deflator component) on the browser side also gets 'corrupted' once a large message is sent. This leads to a 'Failed to compress frame' error in console on subsequent attempts to send more messages (even small messages) to the socket. This behavior is only reproducible when 'x-webkit-deflate-frame' extension enabled. If server rejects the extension - then browser behaves correctly and the payload does not get truncated, but obviously the compression is not used in this case. Safari 12 does not have this issue. In Safari 12 the 'x-webkit-deflate-frame' extension behaves as expected and large payload does not get truncated. 1576154 1 ap 2019-10-02 13:43:02 -0700 Thank you for the report! Do you have a live website that we could reproduce this? 1576155 2 webkit-bug-importer 2019-10-02 13:43:16 -0700 <rdar://problem/55922632> 1576387 3 volodymyr.sorokin 2019-10-03 06:55:11 -0700 I wasn't able to find a public working websocket server that supports 'permessage-deflate' extension. But I created a simple server on java to reproduce the issue: 1) Clone it from https://github.com/vlsorokin/websocket-sandbox 2) Run server > mvn compile exec:java 3) To run client open this jsfiddle in Safari 13: http://jsfiddle.net/sorrro/8b3yawod/ 4) Click - Connect, Send short text, Send large text, Send short text This will send to a websocket a random string of 10 characters, then a random string of 10,000 characters, then 10 characters again 5) You will notice an error in console saying: 'Failed to compress frame' 6) Server logs will indicate that the server has not received less than 10,000 characters 7) If you inspect traffic with Wireshark you may notice that in Safari 13, a large frame gets truncated to 4092 bytes and the second short message does not get sent. At the same time, these steps work fine in Chrome. 1576435 4 ap 2019-10-03 09:13:38 -0700 Thank you. More direct steps to reproduce would help (it's unlikely that anyone here has JDK installed), but we can probably figure it out. Sadly, we had a test for deflate fail for a long time: ../OpenSource/LayoutTests/platform/win/TestExpectations:3177:http/tests/websocket/tests/hybi/deflate-frame-parameter.html [ Failure ] ../OpenSource/LayoutTests/platform/ios/TestExpectations:2886:# <rdar://problem/33630526> http/tests/websocket/tests/hybi/deflate-frame-parameter.html is failing on iOS 11 ../OpenSource/LayoutTests/platform/ios/TestExpectations:2887:http/tests/websocket/tests/hybi/deflate-frame-parameter.html [ Failure ] ../OpenSource/LayoutTests/platform/mac/TestExpectations:1569:[ HighSierra+ ] http/tests/websocket/tests/hybi/deflate-frame-parameter.html [ Failure ] ../OpenSource/LayoutTests/platform/wincairo/TestExpectations:972:http/tests/websocket/tests/hybi/deflate-frame-parameter.html [ Failure ] 1576469 5 volodymyr.sorokin 2019-10-03 10:40:38 -0700 There is nothing special in that java websocket server (I shared it to have a complete working example) I.e. any server that supports `x-webkit-deflate-frame` extension should be enough, so hopefully you will be able to reproduce the bug with your own server (just make sure you use Safari 13 and `x-webkit-deflate-frame` extension is enabled). p.s minor correction: I wrote "permessage-deflate extension" in my previous comment, but I meant "x-webkit-deflate-frame extension" (which is default in Safari) 1584214 6 fabrizio.ruggeri 2019-10-26 02:18:05 -0700 Any news on the status of this? Does it affect any other browser? 1590575 7 berkus 2019-11-15 11:26:34 -0800 Fabrizio, as far as I'm aware it only affects Safari 13 (Safari 13.0.2 included), but on both macOS and iOS (and probably ipadOS). 1592645 8 youennf 2019-11-21 20:43:25 -0800 I can repro the failure with Volodymyr repro case. Failure happens after sending 32kb roughly. Reverting https://trac.webkit.org/changeset/246573 fixes the issue in that specific case. 1592688 9 384131 youennf 2019-11-22 01:08:06 -0800 Created attachment 384131 Patch 1592761 10 berkus 2019-11-22 06:12:34 -0800 @Volodymyr Sorokin We have force-disabled support for "x-webkit-deflate-frame" extension on the server side. This seems to work around the problem for the time being. 1592844 11 ap 2019-11-22 09:32:22 -0800 *** Bug 204237 has been marked as a duplicate of this bug. *** 1593355 12 384131 commit-queue 2019-11-25 00:50:20 -0800 Comment on attachment 384131 Patch Clearing flags on attachment: 384131 Committed r252847: <https://trac.webkit.org/changeset/252847> 1593356 13 commit-queue 2019-11-25 00:50:22 -0800 All reviewed patches have been landed. Closing bug. 384131 2019-11-22 01:08:06 -0800 2019-11-25 00:50:20 -0800 Patch bug-202401-20191122100804.patch text/plain 5842 youennf U3VidmVyc2lvbiBSZXZpc2lvbjogMjUyNzI4CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNThmNTJmNjY1ZTlmOTg2 ZDI0YzEzZGJjMjZhOThmY2JkYjZkMjIxYi4uMWUzYjZlMjU5NzhkZGQwN2JjMjcwNjMzYTE1MzBk NjQ3YjQ4Nzc0YyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDE5LTExLTIyICBZb3Vl bm4gRmFibGV0ICA8eW91ZW5uQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OIChTYWZh cmkgMTMpOiBXZWJTb2NrZXQgcGF5bG9hZCBpcyB0cnVuY2F0ZWQgd2hlbiB4LXdlYmtpdC1kZWZs YXRlLWZyYW1lIGlzIHVzZWQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19i dWcuY2dpP2lkPTIwMjQwMQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNTU5MjI2MzI+CisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGVzdDogaHR0cC90 ZXN0cy93ZWJzb2NrZXQvdGVzdHMvaHliaS9kZWZsYXRlLWV4dGVuc2lvbi5odG1sCisKKyAgICAg ICAgKiBNb2R1bGVzL3dlYnNvY2tldHMvV2ViU29ja2V0RGVmbGF0ZXIuY3BwOgorICAgICAgICAo V2ViQ29yZTo6V2ViU29ja2V0RGVmbGF0ZXI6OmZpbmlzaCk6CisgICAgICAgIE1ha2Ugc3VyZSB0 byBjb250aW51ZSBjYWxsaW5nIGRlZmxhdGUgdW50aWwgYWxsIG91dHB1dCBkYXRhIGlzIGZsdXNo ZWQuCisKIDIwMTktMTEtMjAgIFlvdWVubiBGYWJsZXQgIDx5b3Vlbm5AYXBwbGUuY29tPgogCiAg ICAgICAgIEVuYWJsZSBsZWdhY3kgZ2V0VXNlck1lZGlhIGFzIGEgcXVpcmsKZGlmZiAtLWdpdCBh L1NvdXJjZS9XZWJDb3JlL01vZHVsZXMvd2Vic29ja2V0cy9XZWJTb2NrZXREZWZsYXRlci5jcHAg Yi9Tb3VyY2UvV2ViQ29yZS9Nb2R1bGVzL3dlYnNvY2tldHMvV2ViU29ja2V0RGVmbGF0ZXIuY3Bw CmluZGV4IDRhNDg2NWY4NDk0ZDA2MTNlYWMzMjFhNTk0ZjhiYWUxOTk5NmJiMzEuLmI2NGRlMjRj MGNlMzFkMzUzOTk0YmJlYWMwM2ExMjFiN2MzZThjNTEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJD b3JlL01vZHVsZXMvd2Vic29ja2V0cy9XZWJTb2NrZXREZWZsYXRlci5jcHAKKysrIGIvU291cmNl L1dlYkNvcmUvTW9kdWxlcy93ZWJzb2NrZXRzL1dlYlNvY2tldERlZmxhdGVyLmNwcApAQCAtMTAx LDExICsxMDEsMTMgQEAgYm9vbCBXZWJTb2NrZXREZWZsYXRlcjo6ZmluaXNoKCkKICAgICAgICAg c2l6ZV90IGF2YWlsYWJsZUNhcGFjaXR5ID0gbV9idWZmZXIuc2l6ZSgpIC0gd3JpdGVQb3NpdGlv bjsKICAgICAgICAgc2V0U3RyZWFtUGFyYW1ldGVyKG1fc3RyZWFtLmdldCgpLCAwLCAwLCBtX2J1 ZmZlci5kYXRhKCkgKyB3cml0ZVBvc2l0aW9uLCBhdmFpbGFibGVDYXBhY2l0eSk7CiAgICAgICAg IGludCByZXN1bHQgPSBkZWZsYXRlKG1fc3RyZWFtLmdldCgpLCBaX1NZTkNfRkxVU0gpOwotICAg ICAgICBtX2J1ZmZlci5zaHJpbmsod3JpdGVQb3NpdGlvbiArIGF2YWlsYWJsZUNhcGFjaXR5IC0g bV9zdHJlYW0tPmF2YWlsX291dCk7Ci0gICAgICAgIGlmIChyZXN1bHQgPT0gWl9PSykKLSAgICAg ICAgICAgIGJyZWFrOwotICAgICAgICBpZiAocmVzdWx0ICE9IFpfQlVGX0VSUk9SKQotICAgICAg ICAgICAgcmV0dXJuIGZhbHNlOworICAgICAgICBpZiAobV9zdHJlYW0tPmF2YWlsX291dCkgewor ICAgICAgICAgICAgbV9idWZmZXIuc2hyaW5rKHdyaXRlUG9zaXRpb24gKyBhdmFpbGFibGVDYXBh Y2l0eSAtIG1fc3RyZWFtLT5hdmFpbF9vdXQpOworICAgICAgICAgICAgaWYgKHJlc3VsdCA9PSBa X09LKQorICAgICAgICAgICAgICAgIGJyZWFrOworICAgICAgICAgICAgaWYgKHJlc3VsdCAhPSBa X0JVRl9FUlJPUikKKyAgICAgICAgICAgICAgICByZXR1cm4gZmFsc2U7CisgICAgICAgIH0KICAg ICB9CiAgICAgLy8gUmVtb3ZlIDQgb2N0ZXRzIGZyb20gdGhlIHRhaWwgYXMgdGhlIHNwZWNpZmlj YXRpb24gcmVxdWlyZXMuCiAgICAgaWYgKG1fYnVmZmVyLnNpemUoKSA8PSA0KQpkaWZmIC0tZ2l0 IGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCmluZGV4IDdj ODNiZDhlYzFjNTc5ZjIxZjcyZThiNDQ1NTA3MjI0ZmJkYjhmNDguLmIyZTRiYzdkYzM0OTc3MDFi Yjc3MzE0NjJjMzFhZmFkMmRiZTNjOGIgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL0NoYW5nZUxv ZworKysgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNCBAQAorMjAxOS0xMS0y MiAgWW91ZW5uIEZhYmxldCAgPHlvdWVubkBhcHBsZS5jb20+CisKKyAgICAgICAgUkVHUkVTU0lP TiAoU2FmYXJpIDEzKTogV2ViU29ja2V0IHBheWxvYWQgaXMgdHJ1bmNhdGVkIHdoZW4geC13ZWJr aXQtZGVmbGF0ZS1mcmFtZSBpcyB1c2VkCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0yMDI0MDEKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzU1OTIyNjMy PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogaHR0 cC90ZXN0cy93ZWJzb2NrZXQvdGVzdHMvaHliaS9kZWZsYXRlLWV4dGVuc2lvbi1leHBlY3RlZC50 eHQ6IEFkZGVkLgorICAgICAgICAqIGh0dHAvdGVzdHMvd2Vic29ja2V0L3Rlc3RzL2h5YmkvZGVm bGF0ZS1leHRlbnNpb24uaHRtbDogQWRkZWQuCisKIDIwMTktMTEtMjAgIFlvdWVubiBGYWJsZXQg IDx5b3Vlbm5AYXBwbGUuY29tPgogCiAgICAgICAgIFJlZ3Jlc3Npb24gKHIyNTI2NjApOiBMYXlv dXQgVGVzdCBwbGF0Zm9ybS9pb3MvbWVkaWFzdHJlYW0vYXVkaW8tbXV0ZWQtaW4tYmFja2dyb3Vu ZC10YWIuaHRtbCBpcyBmYWlsaW5nCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9odHRwL3Rlc3Rz L3dlYnNvY2tldC90ZXN0cy9oeWJpL2RlZmxhdGUtZXh0ZW5zaW9uLWV4cGVjdGVkLnR4dCBiL0xh eW91dFRlc3RzL2h0dHAvdGVzdHMvd2Vic29ja2V0L3Rlc3RzL2h5YmkvZGVmbGF0ZS1leHRlbnNp b24tZXhwZWN0ZWQudHh0Cm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAwMDAwMDAw MDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAuLmI5Mzk1NDc5YmJhZjg5MDYzZDM5ZjE1ZGQ5YzJl NWY0ODY5MTE2NjYKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0cy9odHRwL3Rlc3RzL3dl YnNvY2tldC90ZXN0cy9oeWJpL2RlZmxhdGUtZXh0ZW5zaW9uLWV4cGVjdGVkLnR4dApAQCAtMCww ICsxLDEzIEBACitUZXN0IFdlYlNvY2tldCBkZWZsYXRlLWZyYW1lIGV4dGVuc2lvbi4KKworT24g c3VjY2VzcywgeW91IHdpbGwgc2VlIGEgc2VyaWVzIG9mICJQQVNTIiBtZXNzYWdlcywgZm9sbG93 ZWQgYnkgIlRFU1QgQ09NUExFVEUiLgorCitQQVNTIGV2ZW50LmRhdGEgaXMgZmlyc3RNZXNzYWdl CitQQVNTIGV2ZW50LmRhdGEgaXMgc2Vjb25kTWVzc2FnZQorUEFTUyBldmVudC5kYXRhIGlzIHRo aXJkTWVzc2FnZQorb25jbG9zZSgpIHdhcyBjYWxsZWQuCitQQVNTIGNsb3NlRXZlbnQud2FzQ2xl YW4gaXMgdHJ1ZQorUEFTUyBzdWNjZXNzZnVsbHlQYXJzZWQgaXMgdHJ1ZQorCitURVNUIENPTVBM RVRFCisKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvd2Vic29ja2V0L3Rlc3Rz L2h5YmkvZGVmbGF0ZS1leHRlbnNpb24uaHRtbCBiL0xheW91dFRlc3RzL2h0dHAvdGVzdHMvd2Vi c29ja2V0L3Rlc3RzL2h5YmkvZGVmbGF0ZS1leHRlbnNpb24uaHRtbApuZXcgZmlsZSBtb2RlIDEw MDY0NAppbmRleCAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwLi4zZTBl OWE4MzQ1ZDY2NjBmYTg5YzEzY2RjYWM4NGUyYTgzMTRiZmEyCi0tLSAvZGV2L251bGwKKysrIGIv TGF5b3V0VGVzdHMvaHR0cC90ZXN0cy93ZWJzb2NrZXQvdGVzdHMvaHliaS9kZWZsYXRlLWV4dGVu c2lvbi5odG1sCkBAIC0wLDAgKzEsNzMgQEAKKzwhRE9DVFlQRSBIVE1MPgorPGh0bWw+Cis8aGVh ZD4KKzxzY3JpcHQgc3JjPSIuLi8uLi8uLi8uLi9qcy10ZXN0LXJlc291cmNlcy9qcy10ZXN0LXBy ZS5qcyI+PC9zY3JpcHQ+Cis8L2hlYWQ+Cis8Ym9keT4KKzxkaXYgaWQ9ImRlc2NyaXB0aW9uIj48 L2Rpdj4KKzxkaXYgaWQ9ImNvbnNvbGUiPjwvZGl2PgorPHNjcmlwdD4KK2Rlc2NyaXB0aW9uKCJU ZXN0IFdlYlNvY2tldCBkZWZsYXRlLWZyYW1lIGV4dGVuc2lvbi4iKTsKKword2luZG93LmpzVGVz dElzQXN5bmMgPSB0cnVlOworCit2YXIgY2xvc2VFdmVudDsKK3ZhciB3czsKK3ZhciBtZXNzYWdl SW5kZXg7CisKK2Z1bmN0aW9uIHJhbmRvbVRleHQobGVuKSB7CisgICAgY29uc3QgYWxsQ2hhcmFj dGVycyA9ICdBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWmFiY2RlZmdoaWprbG1ub3BxcnN0dXZ3 eHl6MDEyMzQ1Njc4OSc7CisgICAgdmFyIHJhbmRvbVRleHQgPSAnJworICAgIGZvciAodmFyIGkg PSAwOyBpIDwgbGVuOyBpKyspIHsKKyAgICAgICAgdmFyIGsgPSBNYXRoLmZsb29yKE1hdGgucmFu ZG9tKCkgKiBhbGxDaGFyYWN0ZXJzLmxlbmd0aCkKKyAgICAgICAgcmFuZG9tVGV4dCArPSBhbGxD aGFyYWN0ZXJzLmNoYXJBdChrKTsKKyAgICB9CisgICAgcmV0dXJuIHJhbmRvbVRleHQKK30KKwor dmFyIGZpcnN0TWVzc2FnZSA9IHJhbmRvbVRleHQoMTAwMDApOwordmFyIHNlY29uZE1lc3NhZ2Ug PSByYW5kb21UZXh0KDEwMDAwKTsKK3ZhciB0aGlyZE1lc3NhZ2UgPSByYW5kb21UZXh0KDEwMDAw KTsKKworZnVuY3Rpb24gZG9UZXN0KHF1ZXJ5SW5kZXgpCit7CisgICAgdmFyIHVybCA9ICJ3czov L2xvY2FsaG9zdDo4ODgwL3dlYnNvY2tldC90ZXN0cy9oeWJpL2RlZmxhdGUtZnJhbWU/bWF4X3dp bmRvd19iaXRzPTE1IjsKKyAgICB3cyA9IG5ldyBXZWJTb2NrZXQodXJsKTsKKyAgICBtZXNzYWdl SW5kZXggPSAwOworCisgICAgd3Mub25vcGVuID0gZnVuY3Rpb24oZXZlbnQpCisgICAgeworICAg ICAgICB3cy5zZW5kKGZpcnN0TWVzc2FnZSk7CisgICAgfTsKKworICAgIHdzLm9ubWVzc2FnZSA9 IGZ1bmN0aW9uKGV2ZW50KQorICAgIHsKKyAgICAgICAgaWYgKG1lc3NhZ2VJbmRleCA9PT0gMCkg eworICAgICAgICAgICAgc2hvdWxkQmUoImV2ZW50LmRhdGEiLCAiZmlyc3RNZXNzYWdlIik7Cisg ICAgICAgICAgICBtZXNzYWdlSW5kZXggKz0gMQorICAgICAgICAgICAgd3Muc2VuZChzZWNvbmRN ZXNzYWdlKTsKKyAgICAgICAgfSBlbHNlIGlmIChtZXNzYWdlSW5kZXggPT09IDEpIHsKKyAgICAg ICAgICAgIHNob3VsZEJlKCJldmVudC5kYXRhIiwgInNlY29uZE1lc3NhZ2UiKTsKKyAgICAgICAg ICAgIG1lc3NhZ2VJbmRleCArPSAxCisgICAgICAgICAgICB3cy5zZW5kKHRoaXJkTWVzc2FnZSk7 CisgICAgICAgIH0gZWxzZSB7CisgICAgICAgICAgICBzaG91bGRCZSgiZXZlbnQuZGF0YSIsICJ0 aGlyZE1lc3NhZ2UiKTsKKyAgICAgICAgICAgIHdzLmNsb3NlKCk7CisgICAgICAgIH0KKyAgICB9 OworCisgICAgd3Mub25jbG9zZSA9IGZ1bmN0aW9uKGV2ZW50KQorICAgIHsKKyAgICAgICAgZGVi dWcoIm9uY2xvc2UoKSB3YXMgY2FsbGVkLiIpOworICAgICAgICBjbG9zZUV2ZW50ID0gZXZlbnQ7 CisgICAgICAgIHNob3VsZEJlVHJ1ZSgiY2xvc2VFdmVudC53YXNDbGVhbiIpOworICAgICAgICBm aW5pc2hKU1Rlc3QoKTsKKyAgICB9OworfQorCitkb1Rlc3QoMCk7CisKKzwvc2NyaXB0PgorPHNj cmlwdCBzcmM9Ii4uLy4uLy4uLy4uL2pzLXRlc3QtcmVzb3VyY2VzL2pzLXRlc3QtcG9zdC5qcyI+ PC9zY3JpcHQ+Cis8L2JvZHk+Cis8L2h0bWw+Cg==