sahvx655-wq opened a new pull request, #1019:
URL: https://github.com/apache/tomcat/pull/1019

   A WebSocket client that offers permessage-deflate with an invalid window 
size, for example `Sec-WebSocket-Extensions: permessage-deflate; 
client_max_window_bits=16`, makes `PerMessageDeflate.build()` throw. An 
out-of-range value raises `IllegalArgumentException` and a non-numeric or 
value-less `server_max_window_bits` raises `NumberFormatException`; nothing on 
the server handshake path catches either, so the exception unwinds through 
`UpgradeUtil.doUpgrade()` and `WsFilter` and the upgrade is aborted with a 500. 
I traced it from the build stack, which surfaces at the 
`Integer.parseInt`/range check in `build()`, and since permessage-deflate is a 
default-installed extension every endpoint is reachable.
   
   RFC 7692 section 5.1 requires the server to decline an offer that carries an 
invalid parameter, meaning the handshake should complete without that extension 
rather than fail. `build()` already returns `null` when it cannot agree terms, 
so wrapping the parameter loop and routing an invalid parameter down that 
existing decline path keeps the change in the one method that owns extension 
negotiation, with the validation and its messages untouched. The added test 
exercises the three trigger values and fails on the current tree.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to