Function parseRootObject

src/Server/WebTerminalRequestHandler.cpp:265–269

Parse the JSON document and return its root object. Throws on malformed input; the caller treats that as an invalid message and closes the socket. We must parse the full structure (rather than searching for keys by substring) because top-level fields like `type`/`user`/`password` could otherwise be matched inside nested objects in attacker-controlled input.

/// substring) because top-level fields like `type`/`user`/`password` could
/// otherwise be matched inside nested objects in attacker-controlled input.
Poco::JSON::Object::Ptr parseRootObject(const String & json)
{
    Poco::JSON::Parser parser;
    return parser.parse(json).extract<Poco::JSON::Object::Ptr>();
}

/// Read a top-level string field. Returns empty string if the key is missing.
/// Throws on type mismatch.