From 71c3a0f9548ee18310bd84b888060458adce0a97 Mon Sep 17 00:00:00 2001
From: Oskar Eichler <62393985+OskarEichler@users.noreply.github.com>
Date: Sun, 30 Aug 2026 04:50:41 +0200
Subject: [PATCH] Reject masked frames received by clients

---
 lib/websocket/driver/hybi.rb | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/lib/websocket/driver/hybi.rb b/lib/websocket/driver/hybi.rb
index 3487c4a..e823c48 100644
--- a/lib/websocket/driver/hybi.rb
+++ b/lib/websocket/driver/hybi.rb
@@ -322,6 +322,10 @@ def parse_length(octet)
         if @require_masking and not @frame.masked
           return fail(:unacceptable, 'Received unmasked frame but masking is required')
         end
+
+        if @masking and @frame.masked
+          return fail(:protocol_error, 'Received masked frame but masking is forbidden')
+        end
       end
 
       def parse_extended_length(buffer)