ASVS 5.0 V17.3.2 requires that the signaling server keeps processing legitimate messages when it receives malformed ones that could cause a denial of service. The standard points at input validation, safe integer handling, buffer overflow prevention and sound error handling. It is a Level 2 requirement.
One broken message from one client must never take the server down for everyone.
Why it matters
Signaling servers parse JSON or custom protocols, and SDP, a text format with many fields. Deep nesting, huge numbers, missing fields and odd encodings are classic ways to crash a parser or exhaust memory. In native code, bad lengths cause overflows.
How to implement it
- Set a maximum message size before parsing.
- Validate against a schema: types, required fields, string lengths, array sizes, numeric ranges.
- Limit JSON nesting depth and SDP line counts.
- Check integer arithmetic before using values as sizes or indexes.
- Wrap per message handling in an error boundary that closes only that connection.
const Ajv = require("ajv");
const ajv = new Ajv();
const validate = ajv.compile({
type: "object",
required: ["type", "room"],
additionalProperties: false,
properties: {
type: { enum: ["join", "offer", "answer", "candidate", "leave"] },
room: { type: "string", maxLength: 64, pattern: "^[A-Za-z0-9_]+$" },
sdp: { type: "string", maxLength: 20000 }
}
});
ws.on("message", (raw) => {
try {
if (raw.length > 32768) return ws.close(1009);
const msg = JSON.parse(raw);
if (!validate(msg)) return ws.send(JSON.stringify({ error: "invalid" }));
handle(ws, msg);
} catch (e) {
logger.warn({ err: e.message }, "bad signaling message");
ws.close(1003);
}
});
How to test it
Fuzz the endpoint with truncated JSON, a 10 MB string, 100000 nested arrays, negative and huge numbers, invalid UTF-8 and unknown message types. While fuzzing, keep a normal client connected. Pass when the normal client keeps working, the process never restarts, and memory stays flat.
SDP and other text formats
SDP parsing deserves its own care. Limit line count and line length, reject unknown or duplicate critical attributes, cap the number of media sections and candidates, and parse numbers with range checks. If you embed a native SDP parser, keep it patched and fuzz it. In memory safe languages, the main risk shifts to resource exhaustion, so limit the work per message.
Common mistakes
- Parsing first and checking size afterward.
- Validation that allows extra fields to flow into later logic.
- A crash handler that restarts the process but drops every call.
Quick check
Where should size limits be applied?
Before parsing, so a huge payload never reaches the parser.
