Repository navigation
fix(server): clamp like slide indexes - #4
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Audience
likemessages accepted any numeric slide index while projector slide navigation already clamped indexes to the known deck range. A malformed or stale audience client could therefore create like counters for negative or out-of-range slide IDs and send impossiblelike_updatepayloads to the projector. This change reuses one server-side clamp helper for slide navigation, presentation state, and like messages so all slide-indexed WebSocket state stays within the active deck range.How to verify
./run_tests.shfrom the repository root.Notes
Validation before the change:
./run_tests.shpassed with converter Python 124 tests, converter JS 29 tests, server Python 49 tests, and server JS 26 tests. Validation after the change:./run_tests.shpassed with converter Python 124 tests, converter JS 29 tests, server Python 50 tests, and server JS 26 tests. No pre-existing failing checks were observed. The containerized npm installs reported pre-existing audit warnings; dependency updates are intentionally out of scope for this bug fix.