reject reserved close code 1006 in websocket reader

[arshsmith1]

A Close frame's status code is checked in WebSocketReader._handle_frame against ALLOWED_CLOSE_CODES, a set built from the WSCloseCode enum. The enum carries ABNORMAL_CLOSURE (1006), which aiohttp only sets locally when a connection drops without a Close frame, so a frame that arrives with 1006 on the wire passed the check and was delivered as a valid close code (and could be echoed back in aiohttp's own close frame). RFC 6455 7.4.1 reserves 1006, along with 1005 and 1015, and forbids it as a status code on the wire, so 1006 is now rejected as a protocol error the same way 1005 and 1015 already are.

What do these changes do?

Exclude ABNORMAL_CLOSURE from the incoming-frame acceptance set so a Close frame carrying 1006 fails with a protocol error. 1005 and 1015 were already rejected because they are not enum members; only 1006 slipped through.

Are there changes in behavior for the user?

Only for the malformed case. A peer that sends 1006 in a Close frame now trips a protocol error instead of surfacing as a close message. The locally-generated 1006 for an abnormal closure (no Close frame received) is unchanged.

Is it a substantial burden for the maintainers to support this?

No. It drops one reserved code from the acceptance set and adds a regression test beside the existing close-code tests.

Related issue number

None.

Checklist

• I think the code is well written
• Unit tests for the changes exist
• Documentation reflects the changes - N/A, no public API change
• If you provide code modification, please add yourself to CONTRIBUTORS.txt (already listed)
• Add a new news fragment into the CHANGES/ folder

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

_{Reviews (4): Last reviewed commit: "Update test_autobahn.py" | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.02%. Comparing base (c52fe79) to head (2213687).
⚠️ Report is 6 commits behind head on master.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #13536   +/-   ##
=======================================
  Coverage   99.02%   99.02%           
=======================================
  Files         135      135           
  Lines       50486    50500   +14     
  Branches     2650     2652    +2     
=======================================
+ Hits        49993    50007   +14     
  Misses        370      370           
  Partials      123      123           

Flag	Coverage Δ
Autobahn	22.03% <42.85%> (-0.01%)	⬇️
CI-GHA	98.91% <100.00%> (-0.01%)	⬇️
OS-Linux	98.69% <100.00%> (+<0.01%)	⬆️
OS-Windows	97.08% <100.00%> (-0.01%)	⬇️
OS-macOS	97.97% <100.00%> (-0.01%)	⬇️
Py-3.10	98.11% <100.00%> (-0.01%)	⬇️
Py-3.11	98.34% <100.00%> (-0.01%)	⬇️
Py-3.12	98.43% <100.00%> (-0.01%)	⬇️
Py-3.13	98.42% <100.00%> (-0.01%)	⬇️
Py-3.14	98.45% <100.00%> (-0.01%)	⬇️
Py-3.14t	97.61% <100.00%> (-0.01%)	⬇️
Py-pypy-3.11	97.39% <100.00%> (-0.01%)	⬇️
VM-macos	97.97% <100.00%> (-0.01%)	⬇️
VM-ubuntu	98.69% <100.00%> (+<0.01%)	⬆️
VM-windows	97.08% <100.00%> (-0.01%)	⬇️
cython-coverage	83.07% <85.71%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[codspeed-hq]

Merging this PR will not alter performance

✅ 96 untouched benchmarks
⏩ 83 skipped benchmarks¹

---

_{Comparing arshsmith1:ws-reject-reserved-close-code (2213687) with master (2677660)²}

Footnotes

1. 83 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

2. No successful run was found on master (14a1b54) during the generation of this report, so 2677660 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[patchback]

Backport to 3.15: 💚 backport PR created

✅ Backport PR branch: patchback/backports/3.15/20acdf440b0a39c00054d4a70ea59376b793c83d/pr-13536

Backported as #13578

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.