fix(multiplayer): harden websocket frame parser

server/api/events_test.go

@@ -1,12 +1,30 @@
 package api
 
 import (
+	"bufio"
+	"bytes"
 	"net/http"
 	"net/http/httptest"
 	"testing"
 	"time"
 )
 
+func TestWebSocketReaderRejectsClientDataAndReservedOpcodes(t *testing.T) {
+	for _, opcode := range []byte{0x0, 0x1, 0x2, 0x3, 0xB, 0xF} {
+		frame := append([]byte{0x80 | opcode, 0x80, 0, 0, 0, 0}, nil...)
+		if _, _, err := readWebSocketFrame(bufio.NewReader(bytes.NewReader(frame))); err == nil {
+			t.Fatalf("opcode 0x%x was accepted", opcode)
+		}
+	}
+}
+
+func TestWebSocketReaderRejectsOversizedControlFrame(t *testing.T) {
+	frame := append([]byte{0x89, 0xFE, 0, 126, 0, 0, 0, 0}, bytes.Repeat([]byte{0}, 126)...)
+	if _, _, err := readWebSocketFrame(bufio.NewReader(bytes.NewReader(frame))); err == nil {
+		t.Fatal("oversized ping control frame was accepted")
+	}
+}
+
 func TestWebSocketHandshakeRequiresRFC6455Version(t *testing.T) {
 	service := &Service{}
 	request := httptest.NewRequest(http.MethodGet, "/v1/events", nil)