Function isValidWebSocketKey

src/Server/WebTerminalRequestHandler.cpp:56–68

Validate that Sec-WebSocket-Key is a base64-encoded 16-byte nonce per RFC 6455. `base64Decode` (via `Poco::Base64Decoder`) throws `DataFormatException` on malformed input, so swallow exceptions here and treat any decode failure as an invalid key. Otherwise a crafted header would escape as a `500` instead of the deterministic `400` handshake rejection the caller expects.

/// as an invalid key. Otherwise a crafted header would escape as a `500`
/// instead of the deterministic `400` handshake rejection the caller expects.
bool isValidWebSocketKey(const String & key)
{
    if (key.empty() || key.size() > 128)
        return false;
    try
    {
        return base64Decode(key).size() == 16;
    }
    catch (...) /// Ok: malformed base64 is just an invalid key; the caller maps it to a 400 handshake rejection.
    {
        return false;
    }
}

/// Send all bytes to the socket, handling partial writes.
void sendAllBytes(Poco::Net::StreamSocket & socket, const char * data, size_t len)