fix(parse-http): prevent announcement from peers with invalid ports

[SilentBot1]

What is the purpose of this pull request? (put an "X" next to item)

[ ] Documentation update
[x] Bug fix
[ ] New feature
[ ] Other, please explain:

What changes did you make? (Give an overview)

This change implements a small check within parse-http.js to prevent peers with invalid announcement ports from having their announcements accepted or added to the swarm. Valid ports within this implementation are considered any port within the range of 1 - 65535.

Note: Port 0 is excluded as it is invalid for communication between hosts and is only used for local dynamic port binding.

Which issue (if any) does this pull request address?

#512

Is there anything you'd like reviewers to focus on?

[welcome]

🙌 Thanks for opening this pull request! You're awesome.

[ThaUnknown]

wtf, how can this ever occur on an actual network stack?

[SilentBot1]

It is not possible in an actual TCP or UDP connection, any port lower than 1 and higher than 65535 is invalid.

In the UDP tracker, this is handled as the port is a read as a UInt16BE, limiting the value to between 0 to 65535 (of which 0 is still invalid, but doesn't cause a crash).

In the HTTP tracker, this port is cast as a Number directly from user the input, allowing port values outside of the valid port range.

These values then crash the server elsewhere as there are assumptions that only valid port ranges would added to the swarm.

[ThaUnknown]

idk, I don't think I'll ever have time to review this, as there's too many things to understand and consider, such as:
wont this still be an issue here https://github.com/SilentBot1/bittorrent-tracker/blob/20d777a90472874fb02793d0da3dac749cf6d32d/lib/server/parse-websocket.js#L70

[SilentBot1]

wont this still be an issue here https://github.com/SilentBot1/bittorrent-tracker/blob/20d777a90472874fb02793d0da3dac749cf6d32d/lib/server/parse-websocket.js#L70

Due to the port in this case coming from socket.updateReq.connection.remotePort on the line above, this would not be susceptible to the same issue as the port is from the underlaying HTTP(s) connection itself (not a query param), which couldn't establish with an invalid port.

[welcome]

🎉 Congrats on getting your first pull request landed!

[webtorrent-bot]

🎉 This PR is included in version 11.0.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀