Chapter 15: Encoding, Crypto, Randomness, and Parsing Utilities

Every convenience helper has a boundary: encoding is not encryption, pseudorandom is not secure random, and string extraction is not a complete protocol parser.

1. Base64 contract

EncodingUtil::base64_encode() accepts arbitrary bytes. base64_decode() accepts only newline-free Base64 with valid length, alphabet, and padding; invalid input returns an empty string. Empty input also returns an empty string; the calling context retains the distinction between empty and invalid input.

Base64 is not encryption. It provides no confidentiality for passwords, tokens, or keys.

2. SHA-1 and AES-256-CBC

API	Output/behavior	Boundary
`sha1()`	20 raw digest bytes	Protocol compatibility only; not passwords or new signatures
`sha11()`	40 hexadecimal characters	Readable output does not add security
`encryptSymmetric(...,outputLength)`	AES-256-CBC with actual ciphertext length	Output capacity is at least plaintext length + `EVP_MAX_BLOCK_LENGTH`
`decryptSymmetric(...,outputLength)`	Validates padding and returns actual plaintext length	Binary output is not NUL-terminated

Overloads without outputLength remain for compatibility. The length-returning overloads expose the exact number of output bytes. CBC does not authenticate ciphertext; transport is normally protected by TLS, while stored ciphertext also needs authentication or AEAD.

3. Random text

RandomUtil::getRandomStr_base64(str,n) returns exactly n pseudorandom characters from the Base64 alphabet. It has no = padding and is not necessarily decodable Base64 because it is not encoded random bytes. Suitable uses include display IDs, samples, and tests; security tokens, keys, and IVs require a cryptographic random source.

4. Numbers, precision, and byte order

NumberStringConvertUtil requires the entire input to be valid; 8080abc uses the fallback.
toBool() returns true only for true/True/TRUE; every other string becomes false and there is no separate failure state.
PrecisionUtil offers formatted-string and in-place numeric variants. Exact accounting values are better represented by decimal fixed-point or dedicated high-precision types.
NetworkOrderUtil::htonl_ntohl_64() swaps eight bytes for STTNet's 64-bit Linux unsigned long ABI; explicit uint64_t is clearer for new protocols.

5. HTTP, query, and bit helpers

Helper	Guaranteed	Not guaranteed
`get_value_header`	Case-insensitive field names and optional SP/HTAB after the colon	Not a complete HTTP parser
`get_value_str`	Matches query keys on `&` field boundaries	No URL decoding; missing and empty values both produce an empty view/string
`WebsocketStringUtil`	Computes the RFC 6455 Accept value	Normally unnecessary in application code
`BitUtil`	Rejects overlong/non-binary input and invalid bit positions	Uses zero/empty output rather than a unified error object

string_view lifetime: the HttpStringUtil view overloads point into the input string. The view becomes invalid when the source is destroyed, reallocated, or modified; long-lived use stores an owning std::string copy.

Server callbacks normally use the parsed HttpRequestInformation. These helpers are mainly for controlled strings and protocol implementation.

Crypto and encoding demo · Data conversion demo · Protocol parsing demo