Fix 1911 (#1922)

* start new dev branch; add audit file

* Add failing tests: asyncio RawSocket receive limit must be configurable (#1911)

The asyncio RawSocket receive size limit is hardwired to 16 MB: the dead
max_size=None branch in RawSocketProtocol.__init__ always yields length exponent
15, and there is no asyncio equivalent of the Twisted factory's
setProtocolOptions(maxMessagePayloadSize=...). So an asyncio WAMP peer cannot
tighten its receive cap for DoS hardening, and Crossbar's rawsocket
max_message_size has no effect on the asyncio path - a both-backend parity gap.

- test_aio_rawsocket.py: parametrized tests (RECV_LIMIT_CASES) asserting that
  after setProtocolOptions(maxMessagePayloadSize=N) the server handshake
  advertises the configured length exponent and enforces the matching receive
  cap (N rounded up to the next power of two), plus a test that a frame declaring
  more octets than the configured cap (but under 16 MB) is rejected.
- test_tx_rawsocket.py: the same table asserted against the Twisted backend
  (already configurable) as the parity contract - the two backends cannot be
  imported into one process (autobahn.twisted forces txaio.use_twisted), so
  parity is pinned by both matching the same formula.

To make the asyncio red behavioural rather than an AttributeError,
setProtocolOptions/resetProtocolOptions are added to the asyncio factory but not
yet applied to the protocol (__call__ ignores the configured value), so the new
tests fail because the cap stays hardwired at 16 MB. Enforcement lands next.

Note: This work was completed with AI assistance (Claude Code).

* Make the asyncio RawSocket receive limit configurable (#1911)

Activate the configuration surface added in the previous commit so
setProtocolOptions(maxMessagePayloadSize=...) actually reaches the protocol,
reaching parity with the Twisted backend.

- WampRawSocketFactory.__call__ now pushes the factory's _max_message_size onto
  the protocol via _set_max_message_size().
- RawSocketProtocol grows _set_max_message_size(max_size), which rounds the
  configured max up to the next power of two and derives the advertised
  handshake length exponent (2 ** (9 + exp)) and enforced receive cap, the same
  formula the Twisted backend uses. The dead max_size=None branch in __init__ is
  removed; __init__ keeps the 16 MB default for a protocol built without a
  factory.

An asyncio WAMP peer can now tighten its RawSocket receive cap for DoS
hardening, and Crossbar's RawSocket max_message_size takes effect on the asyncio
path. Makes the tests added in the previous commit pass; the Twisted parity test
pins both backends to the same accept/reject decisions.

Note: This work was completed with AI assistance (Claude Code).

Author: oberstet

.audit/oberstet_fix_1911.md

@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the projects' [AI Policy](https://github.com/crossbario/autobahn-python/blob/main/AI_POLICY.md) when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2026-07-14
+Related issue(s): #1911
+Branch: oberstet:fix_1911

docs/changelog.rst

@@ -13,6 +13,7 @@ Changelog
 * Fix WebSocket ``maxMessagePayloadSize`` being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress (deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed with close code 1009 (message too big) before delivery — for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past ``maxMessagePayloadSize`` is now rejected where it previously passed; uncompressed traffic and the per-frame ``maxFramePayloadSize`` wire guard are unaffected (#1909)
 * Fix the permessage-deflate ``max_message_size`` receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded ``decompress(…, max_length)`` left the remaining input in ``unconsumed_tail`` undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises ``PayloadExceededError`` as soon as the uncompressed size would exceed the cap (#1908)
 * Make bounded decompression backend-agnostic: ``decompress_message_data()`` gains an optional ``max_output_len`` argument (documented on the ``PerMessageCompress`` base class) and every permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, inflate the frame (already bounded on the wire by ``maxFramePayloadSize``) and then reject — a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining ``maxMessagePayloadSize`` budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check (#1909) remains as a backstop. Previously only deflate had any decompressed-output cap, so a snappy/bzip2/brotli frame could inflate fully into memory first (#1910)
+* Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio ``WampRawSocketFactory`` now exposes ``setProtocolOptions(maxMessagePayloadSize=...)`` / ``resetProtocolOptions()`` (bounds ``[512, 2**24]``, default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead ``max_size=None`` branch), so an asyncio WAMP peer could not tighten its RawSocket receive limit for DoS hardening and Crossbar's RawSocket ``max_message_size`` had no effect on the asyncio path (#1911)
 
 **FlatBuffers**
 

src/autobahn/asyncio/rawsocket.py

@@ -177,16 +177,22 @@ def stringReceived(self, data):
 
 class RawSocketProtocol(PrefixProtocol):
     def __init__(self):
-        max_size = None
-        if max_size:
-            exp = int(math.ceil(math.log(max_size, 2))) - 9
-            if exp > 15:
-                raise ValueError("Maximum length is 16M")
-            self.max_length = 2 ** (exp + 9)
-            self._length_exp = exp
-        else:
-            self._length_exp = 15
-            self.max_length = 2**24
+        # Default receive cap: 16 MB (length exponent 15). The factory overrides
+        # this from setProtocolOptions(maxMessagePayloadSize=...) via
+        # _set_max_message_size() when the protocol is built.
+        self._length_exp = 15
+        self.max_length = 2**24
+
+    def _set_max_message_size(self, max_size):
+        # Round the configured max up to the next power of two and derive the
+        # advertised handshake length exponent (the peer is asked to send
+        # messages of at most 2 ** (9 + exp) octets), mirroring the Twisted
+        # backend so both enforce and advertise the same receive cap.
+        exp = int(math.ceil(math.log(max_size, 2))) - 9
+        if exp < 0 or exp > 15:
+            raise ValueError("maxMessagePayloadSize must be in [512, 2 ** 24]")
+        self._length_exp = exp
+        self.max_length = 2 ** (exp + 9)
 
     def connection_made(self, transport):
         PrefixProtocol.connection_made(self, transport)
@@ -477,10 +483,45 @@ class WampRawSocketFactory:
 
     log = txaio.make_logger()
 
+    # RawSocket max payload size is 16M
+    # (https://wamp-proto.org/_static/gen/wamp_latest_ietf.html#handshake)
+    _max_message_size = 2**24
+
+    def resetProtocolOptions(self):
+        self._max_message_size = 2**24
+
+    def setProtocolOptions(self, maxMessagePayloadSize=None):
+        """
+        Set RawSocket protocol options. Mirrors the Twisted RawSocket factory so
+        the same ``maxMessagePayloadSize`` knob configures the receive size limit
+        on both backends.
+
+        :param maxMessagePayloadSize: Maximum length (in octets) of a received
+            RawSocket message, in ``[512, 2**24]``; rounded up to the next power
+            of two for the advertised handshake length exponent. ``None`` leaves
+            the current value unchanged (default ``2**24`` = 16 MB).
+        """
+        self.log.debug(
+            "{klass}.setProtocolOptions(maxMessagePayloadSize={maxMessagePayloadSize})",
+            klass=self.__class__.__name__,
+            maxMessagePayloadSize=maxMessagePayloadSize,
+        )
+        assert maxMessagePayloadSize is None or (
+            isinstance(maxMessagePayloadSize, int)
+            and maxMessagePayloadSize >= 512
+            and maxMessagePayloadSize <= 2**24
+        )
+        if (
+            maxMessagePayloadSize is not None
+            and maxMessagePayloadSize != self._max_message_size
+        ):
+            self._max_message_size = maxMessagePayloadSize
+
     @public
     def __call__(self):
         proto = self.protocol()
         proto.factory = self
+        proto._set_max_message_size(self._max_message_size)
         return proto
 
 

src/autobahn/asyncio/test/test_aio_rawsocket.py

@@ -309,3 +309,62 @@ def test_wamp_client_bad_magic_byte_aborts_cleanly():
 
     transport.close.assert_called_once_with()
     client.onOpen.assert_not_called()
+
+
+# ---------------------------------------------------------------------------
+# Issue #1911: the asyncio RawSocket receive size limit must be configurable via
+# the factory's setProtocolOptions(maxMessagePayloadSize=...), at parity with the
+# Twisted backend. Both round the configured max up to the next power of two for
+# the advertised handshake length exponent and the enforced receive cap. Parity
+# is asserted against the same formula in the Twisted suite
+# (test_tx_rawsocket.py), because the two backends cannot be imported into one
+# process (autobahn.twisted forces txaio.use_twisted).
+
+# (maxMessagePayloadSize, advertised length exponent, enforced receive cap)
+RECV_LIMIT_CASES = [
+    (512, 0, 512),
+    (1000, 1, 1024),  # rounded up to the next power of two
+    (1024, 1, 1024),
+    (4096, 3, 4096),
+    (2**20, 11, 2**20),
+    (2**24, 15, 2**24),
+]
+
+
+def _make_configured_server(max_size):
+    transport = Mock(spec_set=("abort", "close", "write", "get_extra_info"))
+    messages = []
+    transport.write = Mock(side_effect=lambda m: messages.append(m))
+    session = Mock(spec=["onOpen", "onMessage"])
+    factory = WampRawSocketServerFactory(lambda: session)
+    factory.setProtocolOptions(maxMessagePayloadSize=max_size)
+    proto = factory()
+    proto.connection_made(transport)
+    ser_id = sorted(proto.factory._serializers.keys())[0]
+    # client opening handshake: magic, (length-exp 15 | serializer id), 0, 0
+    proto.data_received(bytes(bytearray([0x7F, 0xF0 | ser_id, 0, 0])))
+    return proto, transport, messages
+
+
+@pytest.mark.skipif(
+    not os.environ.get("USE_ASYNCIO", False), reason="test runs on asyncio only"
+)
+@pytest.mark.parametrize("max_size,exp,cap", RECV_LIMIT_CASES)
+def test_server_receive_limit_advertised_and_enforced(max_size, exp, cap):
+    proto, transport, messages = _make_configured_server(max_size)
+    # the server handshake reply advertises the configured length exponent
+    reply = messages[0]
+    assert reply[1] >> 4 == exp
+    # and the enforced receive cap reflects the configured max
+    assert proto.max_length == cap
+
+
+@pytest.mark.skipif(
+    not os.environ.get("USE_ASYNCIO", False), reason="test runs on asyncio only"
+)
+def test_server_receive_limit_rejects_oversized_frame():
+    # configure a 1024-octet receive cap; a frame declaring 2000 octets (over the
+    # configured cap but under the hardwired 16 MB default) must be rejected.
+    proto, transport, messages = _make_configured_server(1024)
+    proto.data_received(b"\x00" + (2000).to_bytes(3, "big"))
+    assert transport.close.called

src/autobahn/twisted/test/test_tx_rawsocket.py

@@ -70,6 +70,38 @@ def test_handshake_succeeds(self):
         session_mock.onOpen.assert_called_once_with(p)
         server_session_mock.onOpen.assert_called_once_with(sp)
 
+    def test_receive_limit_advertised_and_enforced(self):
+        """
+        ``setProtocolOptions(maxMessagePayloadSize=...)`` configures the server's
+        received-message size cap: the advertised handshake length exponent and
+        the enforced ``MAX_LENGTH`` are the configured max rounded up to the next
+        power of two. This mirrors the asyncio backend (see
+        ``test_aio_rawsocket.RECV_LIMIT_CASES``) so both backends make identical
+        accept/reject decisions for the same configuration (#1911).
+        """
+        # (maxMessagePayloadSize, advertised length exponent, enforced cap)
+        cases = [
+            (512, 0, 512),
+            (1000, 1, 1024),  # rounded up to the next power of two
+            (1024, 1, 1024),
+            (4096, 3, 4096),
+            (2**20, 11, 2**20),
+            (2**24, 15, 2**24),
+        ]
+        for max_size, exp, cap in cases:
+            with self.subTest(max_size=max_size):
+                sf = WampRawSocketServerFactory(lambda: Mock())
+                sf.setProtocolOptions(maxMessagePayloadSize=max_size)
+                sp = sf.buildProtocol(None)
+                sp.transport = FakeTransport()
+                sp.connectionMade()
+                ser_id = sorted(sf._serializers.keys())[0]
+                # client opening handshake: magic, (length-exp 15 | serializer)
+                sp.dataReceived(bytes([0x7F, 0xF0 | ser_id, 0, 0]))
+                written = sp.transport._written
+                self.assertEqual(written[1] >> 4, exp)
+                self.assertEqual(sp.MAX_LENGTH, cap)
+
     def test_server_bad_magic_byte_aborts_cleanly(self):
         """
         A server receiving an invalid magic byte in the opening handshake