*     throw new SecurityException("Path traversal attempt detected");
     * }
     * </pre>
     *
     * @param pathToCheck the path to validate (must not be {@literal null})
     * @param baseDirectory the base directory that the path must be within (must not be {@literal null})
     * @return true if the path is safe (within the base directory), false otherwise
     */

    assertWithMessage(
            rootLocaleFormat("%s must be annotated with @TesterAnnotation.", annotationClass))
        .that(annotationClass.getAnnotation(TesterAnnotation.class))
        .isNotNull();
    Retention retentionPolicy = annotationClass.getAnnotation(Retention.class);
    assertWithMessage(rootLocaleFormat("%s must have a @Retention annotation.", annotationClass))
        .that(retentionPolicy)

    val isMasked = b1 and B1_FLAG_MASK != 0
    if (isMasked == isClient) {
      // Masked payloads must be read on the server. Unmasked payloads must be read on the client.
      throw ProtocolException(
        if (isClient) {
          "Server-sent frames must not be masked."
        } else {
          "Client-sent frames must be masked."
        },
      )
    }

 * method equivalent to {@link java.util.concurrent.locks.ReentrantLock#hasQueuedThread(Thread)}. If
 * the {@link #callAndAssertWaits} method is ever called in a test, the lock-like object must have a
 * method equivalent to {@link
 * java.util.concurrent.locks.ReentrantLock#hasWaiters(java.util.concurrent.locks.Condition)},

 * method equivalent to {@link java.util.concurrent.locks.ReentrantLock#hasQueuedThread(Thread)}. If
 * the {@link #callAndAssertWaits} method is ever called in a test, the lock-like object must have a
 * method equivalent to {@link
 * java.util.concurrent.locks.ReentrantLock#hasWaiters(java.util.concurrent.locks.Condition)},

    // https://daniel.haxx.se/blog/2016/08/18/http2-connection-coalescing/

    // 1. This connection must be HTTP/2.
    if (http2Connection == null) return false

    // 2. The routes must share an IP address.
    if (routes == null || !routeMatchesAny(routes)) return false

    // 3. This connection's server certificates must cover the new host.
    if (address.hostnameVerifier !== OkHostnameVerifier) return false

     *
     * @param protocols the protocols to use, in order of preference. If the list contains
     *     [Protocol.H2_PRIOR_KNOWLEDGE] then that must be the only protocol and HTTPS URLs will not
     *     be supported. Otherwise the list must contain [Protocol.HTTP_1_1]. The list must
     *     not contain null or [Protocol.HTTP_1_0].
     */
    fun protocols(protocols: List<Protocol>) =
      apply {

        this.client = Objects.requireNonNull(client, "client must not be null");
        suggestSettings = Objects.requireNonNull(settings, "settings must not be null");
        this.readingConverter = Objects.requireNonNull(readingConverter, "readingConverter must not be null");
        this.contentsReadingConverter = Objects.requireNonNull(contentsReadingConverter, "contentsReadingConverter must not be null");

     * Must be one of the supported formats.
     */
    private String contentLoc;

    /**
     * A URL pointing to a player for a specific video.
     * Usually this is the information in the src element of an <embed> tag.
     */
    private String playerLoc;

    /**
     * The duration of the video in seconds.
     * Value must be from 1 to 28800 (8 hours).
     */

        .isEqualTo("Client-sent frames must be masked.")
    }
  }

  @Test fun serverSentFramesMustNotBeMasked() {
    data.write("8180".decodeHex())
    assertFailsWith<ProtocolException> {
      clientReader.processNextFrame()
    }.also { expected ->
      assertThat(expected.message)
        .isEqualTo("Server-sent frames must not be masked.")
    }
  }