Don't treat max_inflate_ratio as a permessage deflate wire parameter

Author: tomciopp

lib/bandit/websocket/permessage_deflate.ex

@@ -21,7 +21,12 @@ defmodule Bandit.WebSocket.PerMessageDeflate do
             deflate_context: nil,
             max_inflate_ratio: nil
 
-  @valid_params ~w[server_no_context_takeover client_no_context_takeover server_max_window_bits client_max_window_bits max_inflate_ratio]
+  # The four extension parameters defined by RFC7692§7. Note that max_inflate_ratio is a
+  # Bandit-internal option (sourced from server config in init/2), NOT a wire parameter:
+  # including it here would both accept it in client offers and echo it back in the
+  # handshake response, and RFC7692§7 forbids a server from including parameters not
+  # defined for the extension
+  @valid_params ~w[server_no_context_takeover client_no_context_takeover server_max_window_bits client_max_window_bits]
 
   def negotiate(requested_extensions, opts) do
     :proplists.get_all_values("permessage-deflate", requested_extensions)

test/bandit/websocket/http1_handshake_test.exs

@@ -274,6 +274,31 @@ defmodule WebSocketHTTP1HandshakeTest do
       refute Keyword.get(headers, :"sec-websocket-extensions")
     end
 
+    test "declines permessage-deflate offers containing the internal max_inflate_ratio option",
+         context do
+      client = SimpleWebSocketClient.tcp_client(context)
+
+      SimpleHTTP1Client.send(client, "GET", "/compress", [
+        "Host: server.example.com",
+        "Upgrade: WeBsOcKeT",
+        "Connection: UpGrAdE",
+        "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==",
+        "Sec-WebSocket-Version: 13",
+        "Sec-WebSocket-Extensions: permessage-deflate;max_inflate_ratio=5"
+      ])
+
+      assert {:ok, "101 Switching Protocols", headers, <<>>} =
+               SimpleHTTP1Client.recv_reply(client)
+
+      assert Keyword.get(headers, :upgrade) == "websocket"
+      assert Keyword.get(headers, :connection) == "Upgrade"
+      assert Keyword.get(headers, :"sec-websocket-accept") == "s3pPLMBiTxaQ9kYGzzhZRbK+xOo="
+
+      # max_inflate_ratio is a Bandit config option, not an RFC7692 extension parameter;
+      # an offer containing it is declined (and it must never be echoed in the response)
+      refute Keyword.get(headers, :"sec-websocket-extensions")
+    end
+
     test "does not negotiate permessage-deflate if the client sends repeat option values",
          context do
       client = SimpleWebSocketClient.tcp_client(context)