fix(websocket): strip surrounding whitespace in parseExtensions

[arshsmith1]

This relates to...

N/A

Rationale

parseExtensions in lib/web/websocket/util.js strips only leading whitespace from an extension parameter name and only trailing whitespace from its value:

extensionList.set(
  removeHTTPWhitespace(name, true, false),
  removeHTTPWhitespace(value, false, true)
)

RFC 6455 section 9.1 defines Sec-WebSocket-Extensions on the RFC 7230 header grammar, which allows optional whitespace around the ; and = delimiters. A spec-valid response header therefore keeps whitespace on the untrimmed side of a token, and it lands inside the map key or value:

parseExtensions('permessage-deflate ; client_max_window_bits')
// Map(2) { 'permessage-deflate ' => '', 'client_max_window_bits' => '' }

The handshake then runs extensions.has('permessage-deflate') in connection.js, which is false because of the trailing space, and the connection is failed for a header the server was allowed to send. Parameter values have the mirror problem:

parseExtensions('permessage-deflate; server_max_window_bits = 10')
// Map(2) { 'permessage-deflate' => '', 'server_max_window_bits ' => ' 10' }

PerMessageDeflate looks up server_max_window_bits and gets undefined (the key carries a trailing space), and even where the key matches, isValidClientWindowBits(' 10') rejects the leading space. The window size the server negotiated is dropped.

Only the whitespace handling is touched here; the wider section 9.1 work tracked by the existing TODO (comma-separated extension lists, quoted-string values) is left as is.

Changes

Trim whitespace from both ends of the parameter name and value in parseExtensions.

Features

N/A

Bug Fixes

• parseExtensions no longer retains delimiter-adjacent whitespace in extension parameter names and values, so valid Sec-WebSocket-Extensions responses that use optional whitespace around ;/= negotiate correctly. Covered by a new case in test/websocket/util.js.

Breaking Changes and Deprecations

N/A

Status

• I have read and agreed to the Developer's Certificate of Origin
• Tested
• Benchmarked (optional)
• Documented
• Review ready
• In review
• Merge ready

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.47%. Comparing base (5033aa1) to head (ea92b41).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5714   +/-   ##
=======================================
  Coverage   93.47%   93.47%           
=======================================
  Files         110      110           
  Lines       38906    38906           
=======================================
+ Hits        36366    36367    +1     
+ Misses       2540     2539    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.