[mirotalkc2c] - fix(server): prevent cross-room signaling injection in relaySDP/relayICE

Author: miroslavpejic85

.env.template

@@ -1,5 +1,5 @@
 # ====================================================
-# MiroTalk C2C v.1.3.02 - Environment Configuration
+# MiroTalk C2C v.1.3.03 - Environment Configuration
 # ====================================================
 
 # App environment

backend/server.js

@@ -9,7 +9,7 @@
  * @license For private project or commercial purposes contact us at: license.mirotalk@gmail.com or purchase it directly via Code Canyon:
  * @license https://codecanyon.net/item/mirotalk-c2c-webrtc-real-time-cam-2-cam-video-conferences-and-screen-sharing/43383005
  * @author  Miroslav Pejic - miroslav.pejic.85@gmail.com
- * @version 1.3.02
+ * @version 1.3.03
  */
 
 require('dotenv').config();
@@ -464,9 +464,23 @@ io.sockets.on('connect', (socket) => {
         }
     });
 
+    function peersShareRoom(peerId) {
+        if (typeof peerId !== 'string' || !peerId) return false;
+        for (const channel in socket.channels) {
+            if (channels[channel] && channels[channel][peerId]) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     socket.on('relaySDP', (config) => {
         const { peerId, sessionDescription } = config;
 
+        if (!peersShareRoom(peerId)) {
+            return log.warn('[' + socket.id + '] relaySDP blocked: no shared room with [' + peerId + ']');
+        }
+
         sendToPeer(peerId, sockets, 'sessionDescription', {
             peerId: socket.id,
             sessionDescription: sessionDescription,
@@ -479,6 +493,10 @@ io.sockets.on('connect', (socket) => {
     socket.on('relayICE', (config) => {
         const { peerId, iceCandidate } = config;
 
+        if (!peersShareRoom(peerId)) {
+            return log.warn('[' + socket.id + '] relayICE blocked: no shared room with [' + peerId + ']');
+        }
+
         sendToPeer(peerId, sockets, 'iceCandidate', {
             peerId: socket.id,
             iceCandidate: iceCandidate,

frontend/js/client.js

@@ -9,7 +9,7 @@
  * @license For private project or commercial purposes contact us at: license.mirotalk@gmail.com or purchase it directly via Code Canyon:
  * @license https://codecanyon.net/item/mirotalk-c2c-webrtc-real-time-cam-2-cam-video-conferences-and-screen-sharing/43383005
  * @author  Miroslav Pejic - miroslav.pejic.85@gmail.com
- * @version 1.3.02
+ * @version 1.3.03
  */
 
 const roomId = new URLSearchParams(window.location.search).get('room');

package-lock.json

@@ -1,6 +1,6 @@
 {
     "name": "mirotalkc2c",
-    "version": "1.3.02",
+    "version": "1.3.03",
     "description": "A free WebRTC Cam-2-Cam browser-based video calls",
     "main": "server.js",
     "scripts": {
@@ -44,7 +44,7 @@
         "colors": "^1.4.0",
         "compression": "^1.8.1",
         "cors": "^2.8.6",
-        "dompurify": "^3.4.3",
+        "dompurify": "^3.4.4",
         "dotenv": "^17.4.2",
         "express": "^5.2.1",
         "express-openid-connect": "^3.0.0",