# HG changeset patch
# User Kim Alvefur <zash@zash.se>
# Date 1685115593 -7200
# Node ID b6aaab0846fef650d911198a622d5b04e302cf59
# Parent  8576f94ac90a32d98e760bd39eec29f0e111a9a8
util.sasl.oauthbearer: Tighter parsing of SASL message

Previously the kvsep before and after the kvpairs would have been
included in kvpairs, which is incorrect but should be harmless.

diff -r 8576f94ac90a -r b6aaab0846fe util/sasl/oauthbearer.lua
--- a/util/sasl/oauthbearer.lua	Wed May 24 15:35:28 2023 +0200
+++ b/util/sasl/oauthbearer.lua	Fri May 26 17:39:53 2023 +0200
@@ -11,12 +11,14 @@
 		return "failure", "not-authorized";
 	end
 
-	local gs2_header, kvpairs = message:match("^(n,[^,]*,)(.+)$");
+	-- gs2-header kvsep *kvpair kvsep
+	local gs2_header, kvpairs = message:match("^(n,[^,]*,)\001(.+)\001$");
 	if not gs2_header then
 		return "failure", "malformed-request";
 	end
 	local gs2_authzid = gs2_header:match("^[^,]*,a=([^,]*),$");
 
+	-- key "=" value kvsep
 	local auth_header;
 	for k, v in kvpairs:gmatch("([a-zA-Z]+)=([\033-\126 \009\r\n]*)\001") do
 		if k == "auth" then