Added verification for response ids in jsonrpc protocol

tests/test_jsonrpc.py

@@ -107,12 +107,24 @@ def test_parsing_invalid_arguments(prot):
     ),
 ])
 def test_good_reply_samples(prot, data, id, result):
+    # assume the protocol is awaiting a response for
+    # a request with `id`
+    prot._incomplete_requests = [id]
+
     reply = prot.parse_reply(data)
 
     assert reply.unique_id == id
     assert reply.result == result
 
 
+@pytest.mark.parametrize(('data'), [
+    """{"jsonrpc": "2.0", "result": 19, "id": 9001}"""
+])
+def test_unsolicited_reply_raises_error(prot, data):
+    prot._incomplete_requests = [4]
+    with pytest.raises(InvalidReplyError):
+        reply = prot.parse_reply(data)
+
 @pytest.mark.parametrize(('exc', 'code', 'message'), [
     (JSONRPCParseError, -32700, 'Parse error'),
     (JSONRPCInvalidRequestError, -32600, 'Invalid Request'),

tinyrpc/protocols/jsonrpc.py

@@ -514,6 +514,7 @@ def __init__(
     ) -> None:
         super(JSONRPCProtocol, self).__init__(*args, **kwargs)
         self._id_generator = id_generator
+        self._incomplete_requests = []
 
     def _get_unique_id(self) -> object:
         return next(self._id_generator)
@@ -573,6 +574,7 @@ def create_request(
 
         if not one_way:
             request.unique_id = self._get_unique_id()
+            self._incomplete_requests.append(request.unique_id)
 
         request.method = method
         if args is not None:
@@ -634,6 +636,12 @@ def parse_reply(
             response.result = rep.get('result', None)
 
         response.unique_id = rep['id']
+        if response.unique_id not in self._incomplete_requests:
+            raise InvalidReplyError(
+                'Reply id does not correspond to any sent requests.'
+            )
+        else:
+            self._incomplete_requests.remove(response.unique_id)
 
         return response