HttpServer: match the Upgrade header value case-insensitively (#584)

RFC 6455 4.2.1 requires the Upgrade header value to be matched case-insensitively. Fixes the server-side exact "websocket" comparison and a related bug in WebSocketHandshake::insensitiveStringCompare (which used cmp()==0, accepting any value sorting at/above the expected one).

Fixes #583

Build-verified locally with OpenSSL.

Co-authored-by: Audrius Butkevicius

Author: AudriusButkevicius

ixwebsocket/IXHttpServer.cpp

@@ -9,6 +9,7 @@
 #include "IXGzipCodec.h"
 #include "IXNetSystem.h"
 #include "IXSocketConnect.h"
+#include "IXStrCaseCompare.h"
 #include "IXUserAgent.h"
 #include <cstdint>
 #include <cstring>
@@ -98,7 +99,11 @@ namespace ix
         {
             auto request = std::get<2>(ret);
             std::shared_ptr<ix::HttpResponse> response;
-            if (request->headers["Upgrade"] == "websocket")
+            // The Upgrade header value is case-insensitive (RFC 6455 4.2.1);
+            // e.g. Chrome's remote-debugging proxy sends "Upgrade: WebSocket".
+            const std::string& upgradeHeader = request->headers["Upgrade"];
+            if (!CaseInsensitiveLess::cmp(upgradeHeader, "websocket") &&
+                !CaseInsensitiveLess::cmp("websocket", upgradeHeader))
             {
                 WebSocketServer::handleUpgrade(std::move(socket), connectionState, request);
             }

ixwebsocket/IXWebSocketHandshake.cpp

@@ -36,7 +36,9 @@ namespace ix
 
     bool WebSocketHandshake::insensitiveStringCompare(const std::string& a, const std::string& b)
     {
-        return CaseInsensitiveLess::cmp(a, b) == 0;
+        // Equivalence under the case-insensitive strict weak ordering: neither
+        // string sorts below the other. (cmp(a, b) == 0 only checked a >= b.)
+        return !CaseInsensitiveLess::cmp(a, b) && !CaseInsensitiveLess::cmp(b, a);
     }
 
     std::string WebSocketHandshake::genRandomString(const int len)