From 3d0f8ee65749d88b6c3fb9b7e1b5fc692b48cff1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=89=8B=E7=93=9C=E4=B8=80=E5=8D=81=E9=9B=AA?=
 <nanaeonn@outlook.com>
Date: Sat, 3 May 2025 16:06:51 +0800
Subject: [PATCH] fix

---
 src/onebot/network/websocket-server.ts | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/onebot/network/websocket-server.ts b/src/onebot/network/websocket-server.ts
index 56eb44f0..e56ff884 100644
--- a/src/onebot/network/websocket-server.ts
+++ b/src/onebot/network/websocket-server.ts
@@ -39,8 +39,11 @@ export class OB11WebSocketServerAdapter extends IOB11NetworkAdapter<WebsocketSer
                 wsClient.close();
                 return;
             }
-            //鉴权
-            this.authorize(this.config.token, wsClient, wsReq);
+            // 鉴权 close 不会立刻销毁 当前返回可避免挂载message事件 close 并未立刻关闭 而是存在timer操作后关闭
+            // 引发高危漏洞
+            if (!this.authorize(this.config.token, wsClient, wsReq)) {
+                return;
+            }
             const paramUrl = wsReq.url?.indexOf('?') !== -1 ? wsReq.url?.substring(0, wsReq.url?.indexOf('?')) : wsReq.url;
             const isApiConnect = paramUrl === '/api' || paramUrl === '/api/';
             if (!isApiConnect) {
@@ -150,10 +153,11 @@ export class OB11WebSocketServerAdapter extends IOB11NetworkAdapter<WebsocketSer
         const HeaderClientToken = wsReq.headers.authorization?.split('Bearer ').pop() || '';
         const ClientToken = typeof (QueryClientToken) === 'string' && QueryClientToken !== '' ? QueryClientToken : HeaderClientToken;
         if (ClientToken === token) {
-            return;
+            return true;
         }
         wsClient.send(JSON.stringify(OB11Response.res(null, 'failed', 1403, 'token验证失败')));
         wsClient.close();
+        return false;
     }
 
     private checkStateAndReply<T>(data: T, wsClient: WebSocket) {