nats-io / nats.go / 41859808437

86%

Build Type

push

github

Committed by web-flow

Commit Message

[FIXED] Treat malformed WS close frames as protocol errors (#2226)

Also treats unexpected compression as protocol errors.

This mirrors nats-server's handling of three cases the reader accepted silently:

- A close frame with a one-byte payload is a protocol error
  (RFC 6455 section 5.5.1, it was treated as "no status received").

- A close frame carrying a status an endpoint must not send:
  1004, 1005, 1006, 1015, below 1000, 1016-2999, 5000 and above
  (RFC 6455 section 7.4)

- A compressed (RSV1) frame when permessage-deflate was not negotiated was
  decompressed anyway. Frames are only copied out of the read buffer when
  compression is on, so the decompressed output could overwrite a later
  frame still aliasing the buffer and corrupt its data.
  (RFC 6455 section 5.2 requires failing the connection on an unexpected RSV bit).

In all three cases the client now replies with a close frame carrying
status 1002 and a message, and the read ends with that message as the
error. The compression unit tests now mark compression as negotiated, as
the reader is only handed compressed frames when it is.

Signed-off-by: Waldemar Quevedo <wally@nats.io>
Co-authored-by: Claude Mythos 5.1 <noreply@anthropic.com>

Coverage Stats

21 of 21 new or added lines in 1 file covered. (100.0%)

11 existing lines in 2 files now uncovered.

13186 of 15369 relevant lines covered (85.8%)

50299.65 hits per line