util.sasl.oauthbearer: Fix traceback on authz in unexpected format
authorKim Alvefur <zash@zash.se>
Thu, 02 Mar 2023 14:37:46 +0100
changeset 12922 ed20555f163a
parent 12921 e4de42495fb7
child 12923 7c0e5c7eff7c
util.sasl.oauthbearer: Fix traceback on authz in unexpected format E.g. if you were to just pass "username" without @hostname, the split will return nil, "username" and the nil gets passed to saslprep() and it does not like that.
util/sasl/oauthbearer.lua
--- a/util/sasl/oauthbearer.lua	Wed Mar 01 18:43:54 2023 +0000
+++ b/util/sasl/oauthbearer.lua	Thu Mar 02 14:37:46 2023 +0100
@@ -34,6 +34,10 @@
 
 	local username = jid.prepped_split(gs2_authzid);
 
+	if not username or username == "" then
+		return "failure", "malformed-request", "Expected authorization identity in the username@hostname format";
+	end
+
 	-- SASLprep username
 	username = saslprep(username);