harden: connclass clone-cap at register, ws control-frame limits, uuid recycle-skip, json-escape extjwt/filehost claims, metadata value/key caps, cloak numeric-dotted leak, relaymsg remote-nick, rpc set_oper block validation, isupport 13-token split, multi-hop privmsg routing, connectdelay=0

src/websocket.rs

@@ -326,6 +326,13 @@ fn io_loop<S: WsStream>(
                         Ok(Some((frame, consumed))) => {
                             acc.drain(..consumed);
                             match frame.opcode {
+                                // RFC 6455 §5.5: control frames must be ≤125 bytes and
+                                // never fragmented — drop the connection otherwise
+                                OP_CLOSE | OP_PING | OP_PONG
+                                    if !frame.fin || frame.payload.len() > 125 =>
+                                {
+                                    return
+                                }
                                 OP_CLOSE => return,
                                 OP_PING => {
                                     let _ = stream.write_all(&encode(OP_PONG, &frame.payload));