From b97b3d122d096124d3be4252834beda5703db214 Mon Sep 17 00:00:00 2001 From: Vitali Zaidman Date: Thu, 26 Feb 2026 04:18:15 -0800 Subject: [PATCH] Add URL validation check to prevent crash (#55748) Summary: Pull Request resolved: https://github.com/facebook/react-native/pull/55748 Add defensive check to validate the WebSocket URL before attempting to connect. This prevents potential crashes when an invalid or nil URL is passed to the WebSocket module, which could cause XPC serialization failures deep in the network stack. The crash was observed in during XPC serialization when SocketRocket attempted to open a connection with invalid URL data. Changelog: [Internal] Differential Revision: D94375527 --- .../react-native/React/CoreModules/RCTWebSocketModule.mm | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/packages/react-native/React/CoreModules/RCTWebSocketModule.mm b/packages/react-native/React/CoreModules/RCTWebSocketModule.mm index e29d76a76a23..86667feeb720 100644 --- a/packages/react-native/React/CoreModules/RCTWebSocketModule.mm +++ b/packages/react-native/React/CoreModules/RCTWebSocketModule.mm @@ -10,6 +10,7 @@ #import #import +#import #import #import #import @@ -66,6 +67,14 @@ - (void)invalidate connect : (NSURL *)URL protocols : (NSArray *)protocols options : (JS::NativeWebSocketModule::SpecConnectOptions &) options socketID : (double)socketID) { + if ((URL == nullptr) || URL.absoluteString.length == 0u) { + RCTAssert(NO, @"RCTWebSocketModule: Invalid WebSocket URL passed to connect"); + NSNumber *socketIDNumber = @(socketID); + NSDictionary *body = @{@"message" : @"Invalid WebSocket URL", @"id" : socketIDNumber}; + [self sendEventWithName:@"websocketFailed" body:body]; + return; + } + NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:URL]; // We load cookies from sharedHTTPCookieStorage (shared with XHR and