fix(socketio): unbound binary attachment data per connection without prior authentication

[Totodore]

Motivation

Fix advisory GHSA-55mf-67qm-4wpg

Solution

• Add ws_max_message_size and ws_max_frame_size thresholds (superseed fix(engineioxide): enforce max_payload on the websocket transport #762)
• Add a ParseConfig with three thresholds, all configurable through the SocketIoConfig

    /// Maximum buffer size of all the incoming binary attachments.
    ///
    /// If the sum of each attachment exceeds this limit,
    /// the packet will be dropped and the connection closed.
    ///
    /// Default to 10 MB
    pub max_incoming_binary_buf_size: usize,

    /// Maximum number of incoming binary attachments.
    ///
    /// If the [`incoming_binary_cnt`](ParserState::incoming_binary_cnt) is exceeded,
    /// the packet will be dropped and the connection closed.
    ///
    /// Default to 10_000
    pub max_incoming_binaries: usize,

    /// Timeout after which it is no longer tolerable to wait for partial binary packets,
    /// the entire packet will dropped and the connection closed.
    ///
    /// Default to 60 seconds
    pub packet_completion_timeout: Duration,

[codspeed-hq]

Merging this PR will degrade performance by 13.79%

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

❌ 10 regressed benchmarks
✅ 77 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	Decode packet binary event on /	9 µs	10.7 µs	-15.3%
❌	Decode packet binary event on /custom_nsp	9.1 µs	10.7 µs	-14.81%
❌	Decode packet binary ack on /custom_nsp	9.5 µs	11.1 µs	-14.8%
❌	Decode packet event on /custom_nsp	6.2 µs	7.2 µs	-14.18%
❌	Decode packet event with ack on /custom_nsp	6.2 µs	7.2 µs	-14.18%
❌	Decode packet event with ack on /	6 µs	6.9 µs	-13.52%
❌	Decode packet connect on /custom_nsp	6.1 µs	7.1 µs	-13.46%
❌	Decode packet binary ack on /	9.9 µs	11.4 µs	-13.15%
❌	Decode packet connect on /	5.9 µs	6.8 µs	-12.75%
❌	Decode packet event on /	6.1 µs	6.9 µs	-11.71%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing fix-unauth-bin-packet (708ea9f) with main (a8dff20)}