{"id":"5127fa9d129f90e1","repo":"socketio/socket.io","slug":"illegal-attachments-5127fa","errorCode":null,"errorMessage":"Illegal attachments","messagePattern":"Illegal attachments","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/socket.io-parser/lib/index.ts","lineNumber":240,"sourceCode":"    // look up type\n    const p: any = {\n      type: Number(str.charAt(0)),\n    };\n\n    if (PacketType[p.type] === undefined) {\n      throw new Error(\"unknown packet type \" + p.type);\n    }\n\n    // look up attachments if type binary\n    if (\n      p.type === PacketType.BINARY_EVENT ||\n      p.type === PacketType.BINARY_ACK\n    ) {\n      const start = i + 1;\n      while (str.charAt(++i) !== \"-\" && i != str.length) {}\n      const buf = str.substring(start, i);\n      if (buf != Number(buf) || str.charAt(i) !== \"-\") {\n        throw new Error(\"Illegal attachments\");\n      }\n      const n = Number(buf);\n      if (!isInteger(n) || n < 1) {\n        throw new Error(\"Illegal attachments\");\n      } else if (n > this.opts.maxAttachments) {\n        throw new Error(\"too many attachments\");\n      }\n      p.attachments = n;\n    }\n\n    // look up namespace (if any)\n    if (\"/\" === str.charAt(i + 1)) {\n      const start = i + 1;\n      while (++i) {\n        const c = str.charAt(i);\n        if (\",\" === c) break;\n        if (i === str.length) break;\n      }","sourceCodeStart":222,"sourceCodeEnd":258,"githubUrl":"https://github.com/socketio/socket.io/blob/ae7fb46e08c5ed964b4a1ea8b1703e816511598e/packages/socket.io-parser/lib/index.ts#L222-L258","documentation":"Thrown by decodeString() when parsing the attachments count of a BINARY_EVENT/BINARY_ACK packet: the substring between the type byte and the '-' delimiter is not a valid integer, or the delimiter '-' is missing. The encoded format is '<type><attachments>-<rest>'; a malformed attachments field triggers this.","triggerScenarios":"A binary packet string like '5x-' (non-numeric attachments) or '5abc' (missing '-') causes `buf != Number(buf)` or `str.charAt(i) !== '-'` to be true.","commonSituations":"Corrupted/truncated frames; a producer that builds binary packet strings by hand and forgets the trailing '-' or inserts non-digits; protocol version skew.","solutions":["Always emit binary events through the Encoder so the '<type><count>-...' format is generated correctly.","If hand-encoding, ensure the attachments count is a positive integer followed by '-'.","Validate/drop frames at the transport layer that do not match the binary-packet shape before decoding."],"exampleFix":"// before (hand-built, malformed)\nconst frame = '5' + count + rest; // missing '-' -> throws\n\n// after\nconst frame = '5' + count + '-' + rest;","handlingStrategy":"validation","validationCode":"function validBinaryHeader(s){\n  const m = s.match(/^[56](\\d+)-/);\n  return !!m;\n}","typeGuard":"function hasWellFormedAttachments(s){ return /^[56]\\d+-/.test(s); }","tryCatchPattern":"try { decoder.add(s); }\ncatch(e){ if(/Illegal attachments/.test(e.message)) return; throw e; }","preventionTips":["Always build binary packets through the Encoder.","If hand-encoding, ensure '<type><count>-<rest>' with a positive integer count and '-' delimiter.","Validate frame shape before decoding."],"tags":["parser","binary","attachments","decoder"],"analyzedSha":"ae7fb46e08c5ed964b4a1ea8b1703e816511598e","analyzedAt":"2026-08-03T19:08:14.127Z","schemaVersion":2}