fix: handle close code properly

Author: peter-jerry-ye

examples/moon.mod.json

@@ -4,7 +4,8 @@
   "deps": {
     "moonbitlang/async": {
       "path": ".."
-    }
+    },
+    "moonbitlang/x": "0.4.37"
   },
   "readme": "README.md",
   "repository": "https://github.com/moonbitlang/async",
@@ -13,4 +14,4 @@
   "description": "Examples for `moonbitlang/async`",
   "source": ".",
   "preferred-target": "native"
-}
+}

src/websocket/client.mbt

@@ -275,6 +275,12 @@ pub async fn Client::receive(self : Client) -> Message {
               None
             }
           }
+          // 0-999 not used
+          // 1000-2999 reserved for protocol
+          if (close_code is Other(i) && i < 3000) || close_code is Abnormal {
+            // Invalid close code
+            close_code = ProtocolError
+          }
         } else {
           guard frame.payload is [] else {
             // Invalid close payload

src/websocket/frame.mbt

@@ -20,11 +20,19 @@ async fn[R : @io.Reader] read_frame(reader : R) -> Frame {
   let byte0 = header[0]
   let byte1 = header[1]
   let fin = (byte0.to_int() & 0x80) != 0
+  let rsv1 = (byte0.to_int() & 0x40) != 0
+  let rsv2 = (byte0.to_int() & 0x20) != 0
+  let rsv3 = (byte0.to_int() & 0x10) != 0
   let opcode_byte = byte0 & b'\x0F'
   let opcode = OpCode::from_byte(opcode_byte)
   let masked = (byte1.to_int() & 0x80) != 0
   let mut payload_len = (byte1.to_int() & 0x7F).to_int64()
 
+  // No extensions supported, rejecting frames with RSV bits set
+  if rsv1 || rsv2 || rsv3 {
+    raise FrameError
+  }
+
   // Validate payload length according to RFC 6455 Section 5.5
   if opcode is (Close | Ping | Pong) {
     if !fin {

src/websocket/server.mbt

@@ -145,6 +145,12 @@ async fn ServerConnection::serve_read(self : ServerConnection) -> Unit {
               return
             }
           }
+          // 0-999 not used
+          // 1000-2999 reserved for protocol
+          if (close_code is Other(i) && i < 3000) || close_code is Abnormal {
+            // Invalid close code
+            close_code = ProtocolError
+          }
         } else {
           guard frame.payload is [] else {
             // Invalid close payload