security: upgrade ws, fix origin validation, guard layouts

- Upgrade ws from 8.20.0 to 8.21.0 (CVE-2026-48779 memory exhaustion)
- Reject Origin: null in WebSocket verifyClient
- Add isFinite guard for dagre node positions
- Add NaN/Infinity guard for force layout positions

Author: chindris-mihai-alexandru

package-lock.json

@@ -49,7 +49,7 @@
     "helmet": "^8.2.0",
     "pdf-lib": "^1.17.1",
     "tldraw": "^4.5.0",
-    "ws": "^8.18.0",
+    "ws": "^8.21.0",
     "zod": "^3.23.0"
   },
   "devDependencies": {

package.json

@@ -48,23 +48,26 @@ const wss = new WebSocketServer({
     const origin = info.origin || info.req.headers.origin
     const host = info.req.headers.host
 
-    if (!origin && !host) {
-      callback(true)
+    if (!origin) {
+      callback(false, 403, 'Forbidden: missing origin')
       return
     }
 
-    if (origin) {
-      try {
-        const url = new URL(origin)
-        const allowedHosts = ['localhost', '127.0.0.1', host?.split(':')[0]]
-        if (!allowedHosts.includes(url.hostname)) {
-          callback(false, 403, 'Forbidden: invalid origin')
-          return
-        }
-      } catch {
+    if (origin === 'null') {
+      callback(false, 403, 'Forbidden: null origin')
+      return
+    }
+
+    try {
+      const url = new URL(origin)
+      const allowedHosts = ['localhost', '127.0.0.1', host?.split(':')[0]]
+      if (!allowedHosts.includes(url.hostname)) {
         callback(false, 403, 'Forbidden: invalid origin')
         return
       }
+    } catch {
+      callback(false, 403, 'Forbidden: invalid origin')
+      return
     }
 
     callback(true)

src/canvas-server.ts

@@ -45,7 +45,7 @@ export function computeDagreLayout(
 
   for (const node of graph.nodes) {
     const dagreNode = g.node(node.id)
-    if (!dagreNode) continue
+    if (!dagreNode || !isFinite(dagreNode.x) || !isFinite(dagreNode.y)) continue
 
     const x = dagreNode.x - node.width / 2
     const y = dagreNode.y - node.height / 2

src/layout/dagre.ts

@@ -69,8 +69,12 @@ export function computeForceLayout(
   const positionMap = new Map<string, { x: number; y: number }>()
 
   for (const node of nodes) {
-    const x = (node.x ?? 0) - node.width / 2
-    const y = (node.y ?? 0) - node.height / 2
+    const rawX = node.x ?? 0
+    const rawY = node.y ?? 0
+    const safeX = isFinite(rawX) ? rawX : 0
+    const safeY = isFinite(rawY) ? rawY : 0
+    const x = safeX - node.width / 2
+    const y = safeY - node.height / 2
 
     positions.push({ id: node.id, x, y, width: node.width, height: node.height })
     positionMap.set(node.id, { x, y })