fix: treat invalid/reserved close codes as 1000

Author: mikuso

lib/client.js

@@ -11,6 +11,7 @@ const { getErrorPlainObject, createRPCError, getPackageIdent } = require('./util
 const Queue = require('./queue');
 const EventBuffer = require('./event-buffer');
 const standardValidators = require('./standard-validators');
+const {isValidStatusCode} = require('./ws-util');
 
 const MSG_CALL = 2;
 const MSG_CALLRESULT = 3;
@@ -212,7 +213,10 @@ class RPCClient extends EventEmitter {
                 } else {
                     // await pending calls & responses
                     await this._awaitUntilPendingSettled();
-                    this._ws.close(code ?? 1000, reason);
+                    if (!code || !isValidStatusCode(code)) {
+                        code = 1000;
+                    }
+                    this._ws.close(code, reason);
                 }
 
                 let [codeRes, reasonRes] = await once(this._ws, 'close');

lib/ws-util.js

@@ -108,7 +108,26 @@ function parseSubprotocols(header) {
     return protocols;
 }
 
+/**
+ * Checks if a status code is allowed in a close frame.
+ *
+ * @param {Number} code The status code
+ * @return {Boolean} `true` if the status code is valid, else `false`
+ * @public
+ */
+ function isValidStatusCode(code) {
+    return (
+      (code >= 1000 &&
+        code <= 1014 &&
+        code !== 1004 &&
+        code !== 1005 &&
+        code !== 1006) ||
+      (code >= 3000 && code <= 4999)
+    );
+  }
+
 module.exports = {
     abortHandshake,
     parseSubprotocols,
+    isValidStatusCode,
 };

test/client.js

@@ -888,6 +888,30 @@ describe('RPCClient', function(){
 
         });
 
+        it('should treat invalid/reserved close codes as 1000', async () => {
+
+            const {server, endpoint, close} = await createServer();
+            const cli = new RPCClient({endpoint, identity: 'X'});
+
+            try {
+                const testCodes = [-1000,0,1,1005,10000];
+
+                for (const testCode of testCodes) {
+                    const serverClientPromise = once(server, 'client');
+                    await cli.connect();
+                    const [serverClient] = await serverClientPromise;
+                    const serverClosePromise = once(serverClient, 'close');
+                    await cli.close({code: testCode});
+                    const [serverClose] = await serverClosePromise;
+                    assert.equal(serverClose.code, 1000);
+                }
+
+            } finally {
+                close();
+            }
+
+        });
+
         it('should return the close code of the first close() call', async () => {
 
             const {endpoint, close} = await createServer();