Software / code / prosody
Changeset
3102:5cd408e36359
util.sasl.scram: Parsing client-final-message in a more strict way. (thanks Marc Santamaria)
| author | Tobias Markmann <tm@ayena.de> |
|---|---|
| date | Sat, 22 May 2010 14:47:21 +0200 |
| parents | 3101:9e4439378cf8 |
| children | 3103:87cf90ca8923 |
| files | util/sasl/scram.lua |
| diffstat | 1 files changed, 1 insertions(+), 4 deletions(-) [+] |
line wrap: on
line diff
--- a/util/sasl/scram.lua Sat May 22 13:59:58 2010 +0200 +++ b/util/sasl/scram.lua Sat May 22 14:47:21 2010 +0200 @@ -153,10 +153,7 @@ -- we are processing client_final_message local client_final_message = message; - -- TODO: more strict parsing of client_final_message - self.state["proof"] = client_final_message:match("p=(.+)"); - self.state["nonce"] = client_final_message:match("r=(.+),p="); - self.state["channelbinding"] = client_final_message:match("c=(.+),r="); + self.state["channelbinding"], self.state["nonce"], self.state["proof"] = client_final_message:match("^c=(.*),r=(.*),.*p=(.*)"); if not self.state.proof or not self.state.nonce or not self.state.channelbinding then return "failure", "malformed-request", "Missing an attribute(p, r or c) in SASL message.";
