From 3e59f932dfcf2df3c30d5aad1879e0756a802d98 Mon Sep 17 00:00:00 2001
From: Oskar Eichler <62393985+OskarEichler@users.noreply.github.com>
Date: Sun, 30 Aug 2026 04:50:47 +0200
Subject: [PATCH] Validate WebSocket handshake keys

---
 lib/websocket/driver/hybi.rb | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lib/websocket/driver/hybi.rb b/lib/websocket/driver/hybi.rb
index 3487c4a..dd0a6fe 100644
--- a/lib/websocket/driver/hybi.rb
+++ b/lib/websocket/driver/hybi.rb
@@ -243,6 +243,16 @@ def handshake_response
           raise ProtocolError.new('Missing handshake request header: Sec-WebSocket-Key')
         end
 
+        begin
+          valid_key = Base64.strict_decode64(sec_key).bytesize == 16
+        rescue ArgumentError
+          valid_key = false
+        end
+
+        unless valid_key
+          raise ProtocolError.new('Invalid handshake request header: Sec-WebSocket-Key')
+        end
+
         @headers['Upgrade']              = 'websocket'
         @headers['Connection']           = 'Upgrade'
         @headers['Sec-WebSocket-Accept'] = Hybi.generate_accept(sec_key)