Software / code / prosody
Changeset
13112:b6aaab0846fe
util.sasl.oauthbearer: Tighter parsing of SASL message
Previously the kvsep before and after the kvpairs would have been
included in kvpairs, which is incorrect but should be harmless.
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Fri, 26 May 2023 17:39:53 +0200 |
| parents | 13111:8576f94ac90a |
| children | 13113:191fe4866e3e |
| files | util/sasl/oauthbearer.lua |
| diffstat | 1 files changed, 3 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/util/sasl/oauthbearer.lua Wed May 24 15:35:28 2023 +0200 +++ b/util/sasl/oauthbearer.lua Fri May 26 17:39:53 2023 +0200 @@ -11,12 +11,14 @@ return "failure", "not-authorized"; end - local gs2_header, kvpairs = message:match("^(n,[^,]*,)(.+)$"); + -- gs2-header kvsep *kvpair kvsep + local gs2_header, kvpairs = message:match("^(n,[^,]*,)\001(.+)\001$"); if not gs2_header then return "failure", "malformed-request"; end local gs2_authzid = gs2_header:match("^[^,]*,a=([^,]*),$"); + -- key "=" value kvsep local auth_header; for k, v in kvpairs:gmatch("([a-zA-Z]+)=([\033-\126 \009\r\n]*)\001") do if k == "auth" then
