Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@lib/WebServer/src/detail/RequestHandlersImpl.h`:
- Around line 77-83: canHandle currently allows prefix collisions (e.g., "/foo"
matching "/foobar") because it only checks startsWith(_uri); change the
predicate so when _isFile is true require exact equality (requestUri == _uri),
and when not _isFile require either exact match or that requestUri starts with
_uri followed by a path separator (e.g., requestUri == _uri ||
requestUri.startsWith(_uri + "/")). Update the logic in canHandle to use
_isFile, _uri, requestUri and HTTP_GET accordingly so static routes only match
the exact path or a proper subpath.

In `@lib/WebServer/src/Parsing.cpp`:
- Around line 220-233: The header value parsing drops the first character when
headers are in "Header:Value" form because it uses substring(headerDiv + 2);
change the logic in the headers loop to extract headerValue starting at
headerDiv + 1 (i.e., substring(headerDiv + 1)) and then trim a single leading
space if present (so both "Header:Value" and "Header: Value" are handled).
Update the variables/locations referenced (req, headerDiv, headerName,
headerValue) and continue to call _collectHeader(headerName.c_str(),
headerValue.c_str()) with the corrected value.

In `@lib/WebServer/src/uri/UriBraces.h`:
- Around line 16-26: The placeholder counting in initPathArgs incorrectly
ignores matches at index 0 because it checks start > 0; update the loop in
UriBraces::initPathArgs to treat any non-negative index as a valid match (use
start >= 0 or check for start != -1), increment numParams when start >= 0, then
advance start by 2 and continue while start >= 0; this will ensure
pathArgs.resize(numParams) allocates slots for placeholders at the beginning and
prevents canHandle from writing out of bounds.

In `@lib/WebServer/src/uri/UriGlob.h`:
- Around line 4-19: The current UriGlob class unconditionally uses fnmatch
(included via fnmatch.h) which breaks builds on platforms without fnmatch; wrap
the include and the UriGlob class implementation with a compile-time guard
(e.g., `#ifdef` HAVE_FNMATCH / `#endif`) or introduce a portability macro (e.g.,
USE_FNMATCH) and provide a fallback: if fnmatch is unavailable, either implement
a lightweight glob matcher used by UriGlob::canHandle(const String &requestUri,
std::vector<String> &pathArgs) or implement UriGlob as a thin wrapper that
always returns false from canHandle and documents the limitation; keep
UriGlob::clone() consistent with whichever implementation is chosen and ensure
the guard symbol is documented in the build system so toolchains without fnmatch
can compile.

In `@lib/WebServer/src/WebServer.cpp`:
- Around line 147-154: The code uses a signed 8-bit char for the length
(toencodeLen) causing potential overflow and wrong allocations; change to an
unsigned size type (e.g., size_t or int) when computing
strlen(username)+strlen(password)+1 and use that type for allocations and when
calling base64_encode_expected_len, updating any related variables (toencodeLen,
toencode, encoded) in WebServer.cpp so buffer sizes are computed correctly and
safely; ensure null-checks and allocations use the new size type consistently.
- Around line 197-210: The current digest hash only handles GET/POST/PUT/DELETE
leading to WebDAV methods failing; update the logic around _currentMethod that
builds _H2 so it uses the actual HTTP method string instead of the hardcoded
if/else chain—e.g., derive a methodName from _currentMethod (or use an existing
helper like httpMethodToString/_request->method() if available) that returns
"GET", "POST", "PROPFIND", "MKCOL", "MOVE", etc., then compute _H2 =
md5str(String(methodName) + ':' + _uri) (fallback to "GET" only if methodName is
unknown); reference md5str, _currentMethod, _uri and _H2 when making the change.

In `@lib/WebServer/src/WebServer.h`:
- Around line 2-4: The file header in WebServer.h incorrectly states the server
"Supports only one simultaneous client, knows how to handle GET and POST";
update that top-of-file comment to accurately describe current capabilities of
the WebServer class—mention its concurrency support (single/multi-client as
implemented), and list the actual HTTP methods supported (as implemented by
methods like handleClient() and handleRequest()), and any important behavior
(e.g., request parsing, routing, or payload handling) so integrators aren’t
misled; keep the wording brief and factual to match the current implementation.
- Around line 96-100: The upload() accessor dereferences the std::unique_ptr
_currentUpload unsafely; update WebServer::upload() to guard against null by
returning a safe fallback (for example a reference to a static empty HTTPUpload
instance) or change the API to return a pointer/optional so callers must handle
absence, and ensure callers that expect an active upload still function; refer
to symbols upload(), _currentUpload, HTTPUpload and update WebServer::upload()
implementation (or add clear documentation on the precondition) so dereferencing
a null unique_ptr is never possible.

In `@src/network/WebDAVHandler.cpp`:
- Around line 697-712: isProtectedPath currently only examines the final path
segment so nested hidden directories like "/.hidden/file" bypass protection;
update isProtectedPath to iterate over every path segment (splitting on '/' or
scanning between '/' chars) and for each non-empty segment check if
segment.startsWith(".") or equals any entry in HIDDEN_ITEMS (using HIDDEN_ITEMS
and HIDDEN_ITEMS_COUNT) and return true if so, otherwise return false; keep
existing behavior for empty paths.
- Around line 319-336: The PUT handler currently uses client.readBytes(...) and
file.write(...) without verifying they processed the full requested amount, so
partial reads or short writes produce a truncated file while still returning
201/204; update the upload loop in WebDAVHandler::PUT to check that bytesRead ==
toRead (and break with an error on timeout/0), check the return value of
file.write (or bytesWritten) equals bytesRead, and on any mismatch or failure
close and remove the partial file (or rollback) and send an error response
(e.g., 408/500) instead of 201/204; reference the loop using client.readBytes,
file.write, remaining/contentLength, file.close, and _server->send to locate and
implement these checks and proper cleanup.

---

Nitpick comments:
In `@lib/WebServer/src/WebServer.h`:
- Line 216: The closing `#endif` comment in WebServer.h currently reads
"//ESP8266WEBSERVER_H" but doesn't match the actual header guard macro; open
WebServer.h, locate the top guard macro (the `#ifndef/`#define symbol used for the
include guard) and update the trailing comment on the final `#endif` to exactly
match that macro name (e.g., change the comment to the same identifier found at
the top) so the end-comment aligns with the real guard (reference the macro
symbol at the top of WebServer.h and the existing trailing comment
"ESP8266WEBSERVER_H").