Harden WebSocket request parsing for header casing, body bounds, cookie conversion, and MinGW portability - #27

Please apply the following diffs and create a pull request.
Once the PR is ready, give it a title based on the messages of the fixes being applied.

[{"message":"The HTTP header field name comparison is case-sensitive, but HTTP headers are case-insensitive per RFC 7230. The code should use a case-insensitive comparison (like `strcasestr` if available) or normalize the header before searching to properly handle \"content-length\", \"Content-length\", etc.","fixFiles":[{"filePath":"src/webserver/src/WebSocket.cpp","diff":"diff --git a/src/webserver/src/WebSocket.cpp b/src/webserver/src/WebSocket.cpp\n--- a/src/webserver/src/WebSocket.cpp\n+++ b/src/webserver/src/WebSocket.cpp\n@@ -121,7 +121,7 @@\n \t//\n \t// \"POST\" have \"Content-Length\"\n \tif ( m_IsPost ) {\n-\t\tchar *cont_len = strstr(m_pBuf, \"Content-Length\");\n+\t\tchar *cont_len = strcasestr(m_pBuf, \"Content-Length\");\n \t\t// do we have received all the line ?\n \t\tif ( cont_len && strstr(cont_len, \"\\r\\n\\r\\n\") ) {\n \t\t\tcont_len += strlen(\"Content-Length:\");\n"}]},{"message":"There is a signed/unsigned comparison issue here. The left side of the comparison involves pointer arithmetic that could potentially be negative, while `m_dwRecv` is unsigned. This should be refactored to avoid the cast and potential overflow issues. Consider: `if ( (uint32)(cont - m_pBuf) + len <= m_dwRecv )` with proper overflow checking.","fixFiles":[{"filePath":"src/webserver/src/WebSocket.cpp","diff":"diff --git a/src/webserver/src/WebSocket.cpp b/src/webserver/src/WebSocket.cpp\n--- a/src/webserver/src/WebSocket.cpp\n+++ b/src/webserver/src/WebSocket.cpp\n@@ -128,14 +128,24 @@\n \t\t\t// can be white space following\n \t\t\twhile ( isspace(*cont_len) ) cont_len++;\n \t\t\tint len = atoi(cont_len);\n-\t\t\tif ( !len ) {\n+\t\t\tif ( len <= 0 ) {\n \t\t\t\tClose();\n \t\t\t\treturn ;\n \t\t\t}\n \t\t\t// do we have all of data ?\n \t\t\tchar *cont = strstr(m_pBuf, \"\\r\\n\\r\\n\");\n+\t\t\tif ( !cont ) {\n+\t\t\t\tClose();\n+\t\t\t\treturn ;\n+\t\t\t}\n \t\t\tcont += 4;\n-\t\t\tif ( cont - m_pBuf + len <= (int)m_dwRecv ) {\n+\t\t\tif ( cont < m_pBuf ) {\n+\t\t\t\tClose();\n+\t\t\t\treturn ;\n+\t\t\t}\n+\t\t\tuint32 bodyOffset = static_cast<uint32>(cont - m_pBuf);\n+\t\t\tuint32 bodyLen = static_cast<uint32>(len);\n+\t\t\tif ( bodyLen <= m_dwRecv && bodyOffset <= m_dwRecv - bodyLen ) {\n \t\t\t\tOnRequestReceived(m_pBuf, cont, len);\n \t\t\t}\n \t\t}\n"}]},{"message":"The `strtoull` function is called without checking for conversion errors. If the cookie value contains invalid characters, `strtoull` may return 0 or ULLONG_MAX and set errno, but these conditions are not checked. This could lead to session ID confusion if malformed cookie values are sent.","fixFiles":[{"filePath":"src/webserver/src/WebSocket.cpp","diff":"diff --git a/src/webserver/src/WebSocket.cpp b/src/webserver/src/WebSocket.cpp\n--- a/src/webserver/src/WebSocket.cpp\n+++ b/src/webserver/src/WebSocket.cpp\n@@ -26,6 +26,8 @@\n \n \n #include \"WebSocket.h\"\n+#include <cerrno>\n+#include <cctype>\n \n \n CWebSocket::CWebSocket(CWebServerBase *parent)\n@@ -228,7 +230,15 @@\n \t\tif ( current_cookie ) {\n \t\t\tchar *value = strchr(current_cookie, '=');\n \t\t\tif ( value ) {\n-\t\t\t\tsessid = strtoull(++value, NULL, 10);\n+\t\t\t\t++value;\n+\t\t\t\terrno = 0;\n+\t\t\t\tchar *endptr = NULL;\n+\t\t\t\tunsigned long long parsed = strtoull(value, &endptr, 10);\n+\t\t\t\tif ( endptr != value && errno != ERANGE &&\n+\t\t\t\t\t(*endptr == '\\0' || *endptr == ';' || *endptr == '\\r' || *endptr == '\\n' ||\n+\t\t\t\t\t std::isspace(static_cast<unsigned char>(*endptr))) ) {\n+\t\t\t\t\tsessid = static_cast<uint64_t>(parsed);\n+\t\t\t\t}\n \t\t\t}\n \t\t}\n \t}\n"}]}]