[fix] Reject offers with client_max_window_bits below config

When a server is configured with `clientMaxWindowBits = N` and a client
offers `client_max_window_bits = M` where `M < N`, the server must not
respond with a value greater than `M`.

Previously the server accepted such offers and responded with
`client_max_window_bits = N`. The analogous check for
`serverMaxWindowBits` already existed; this commit adds the symmetric
check for `clientMaxWindowBits`.

Author: JSap0914

lib/permessage-deflate.js

@@ -167,7 +167,9 @@ class PerMessageDeflate {
             (typeof opts.serverMaxWindowBits === 'number' &&
               opts.serverMaxWindowBits > params.server_max_window_bits))) ||
         (typeof opts.clientMaxWindowBits === 'number' &&
-          !params.client_max_window_bits)
+          (typeof params.client_max_window_bits === 'number'
+            ? opts.clientMaxWindowBits > params.client_max_window_bits
+            : !params.client_max_window_bits))
       ) {
         return false;
       }

test/permessage-deflate.test.js

@@ -213,6 +213,21 @@ describe('PerMessageDeflate', () => {
         );
       });
 
+      it('throws an error if client_max_window_bits is less than configuration', () => {
+        const perMessageDeflate = new PerMessageDeflate({
+          isServer: true,
+          clientMaxWindowBits: 11
+        });
+        const extensions = extension.parse(
+          'permessage-deflate; client_max_window_bits=10'
+        );
+
+        assert.throws(
+          () => perMessageDeflate.accept(extensions['permessage-deflate']),
+          /^Error: None of the extension offers can be accepted$/
+        );
+      });
+
       it('throws an error if client_max_window_bits is unsupported on client', () => {
         const perMessageDeflate = new PerMessageDeflate({
           isServer: true,