Crash due to reserved error codes

[dangrima90]

I encountered a crash with the following error:

Error: java.lang.IllegalArgumentException: Code 1005 is reserved and may not be used.

After investigating the issue I found that the code is returned when the connection was closed but there wasn't any status code. In this case the error code is reserved and so the app crashes. It seems that the library should santise the code before closing the websocket connection as certain codes are reserved.

Code in question:

nativescript-plugins/packages/nativescript-websockets/bridge.android.ts

Lines 171 to 173 in 3decf93

	public onClosing(websocket: okhttp3.WebSocket, code: number, reason: string): void {
	websocket.close(code, reason);
	}

I'm no expert in terms of the implementation here, however I checked the reserved status codes for websockets and I found the following: https://datatracker.ietf.org/doc/html/rfc6455#section-7.4.1. So based on this the following code might be applied:

onClosing(websocket, code, reason) {
    const reserved = [1004, 1005, 1006, 1015];
    const safeCode = reserved.includes(code) ? 1000 : code;
    websocket.close(safeCode, reason);
}

[edusperoni]

Hello!

Is there a way to reproduce this issue? It seems like I can't reproduce this no matter how I close my socket. We're using the exact same logic from React Native

https://github.com/facebook/react-native/blob/369a817cf0aaace85a9b62064daaad337b0eb8b3/packages/react-native/ReactAndroid/src/main/java/com/facebook/react/modules/websocket/WebSocketModule.kt#L152-L154

I need to be able to reproduce this somehow so I can properly report this close event to the user (not with a status 1000).

[dangrima90]

Hi @edusperoni! Sorry for not sending reproducible code, I investigated the issue based on a crash report. Anyway I've managed to create test code to replicate it:

// node ws server
const http = require('http');
const WebSocket = require('ws');

const server = http.createServer();
const wss = new WebSocket.Server({ server });

wss.on('connection', (ws, req) => {
  console.log('Client connected');

  // After 3 seconds, send a close frame WITHOUT a status code.
  // OkHttp will report this as code 1005 ("No Status Received") in onClosing.
  setTimeout(() => {
    console.log('Sending close frame with no status code...');
    ws.close();
  }, 3000);
});

server.listen(8080, () => console.log('Listening on ws://localhost:8080'));

The above code sends a WebSocket close frame without a status code on purpose, which causes code 1005. From what I've read this shouldn't be something that happens often, however it could be that certain failures on the network might result in 1005 status code (or other reserved error codes).

Sample code in an Android app:

require('@valor/nativescript-websockets');
const testWs = new WebSocket('ws://10.0.2.2:8080');
testWs.onopen = () => console.log('[TEST] Connected');
testWs.onclose = e => console.log('[TEST] Closed', e.code);
testWs.onerror = e => console.log('[TEST] Error', e);