From 6cd4aeb032b4ea00c5ac021a5d4937eb62b2b631 Mon Sep 17 00:00:00 2001
From: Arpit Jain <3242828+arpitjain099@users.noreply.github.com>
Date: Sun, 4 Oct 2026 01:27:35 -0400
Subject: [PATCH] fix: Do not let a malformed WebSocket frame escape the
 message listener (#33275)

Signed-off-by: Arpit Jain <arpitjain099@gmail.com>
---
 lib/extension/frontend.ts        | 9 +++++++--
 test/extensions/frontend.test.ts | 6 ++++++
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/lib/extension/frontend.ts b/lib/extension/frontend.ts
index 99ed40534..d2a6701a1 100644
--- a/lib/extension/frontend.ts
+++ b/lib/extension/frontend.ts
@@ -163,8 +163,13 @@ export class Frontend extends Extension {
         ws.on("message", (data: Buffer, isBinary: boolean) => {
             if (!isBinary && data) {
                 const message = data.toString();
-                const {topic, payload} = JSON.parse(message);
-                this.mqtt.onMessage(`${this.mqttBaseTopic}/${topic}`, Buffer.from(stringify(payload)));
+
+                try {
+                    const {topic, payload} = JSON.parse(message);
+                    this.mqtt.onMessage(`${this.mqttBaseTopic}/${topic}`, Buffer.from(stringify(payload)));
+                } catch {
+                    logger.error(`Received invalid message from WebSocket: ${message}`);
+                }
             }
         });
 
diff --git a/test/extensions/frontend.test.ts b/test/extensions/frontend.test.ts
index 5323b2871..e21673d66 100644
--- a/test/extensions/frontend.test.ts
+++ b/test/extensions/frontend.test.ts
@@ -262,6 +262,12 @@ describe("Extension: Frontend", () => {
         mockWSClientEvents.message(null, false);
         await flushPromises();
 
+        // Malformed payload, must not escape the listener
+        mockLogger.error.mockClear();
+        expect(() => mockWSClientEvents.message("not json", false)).not.toThrow();
+        expect(mockLogger.error).toHaveBeenCalledWith("Received invalid message from WebSocket: not json");
+        await flushPromises();
+
         // Error
         mockWSClientEvents.error(new Error("This is an error"));
         expect(mockLogger.error).toHaveBeenCalledWith("WebSocket error: This is an error");