Added length checking for authorization header

2025-06-12 04:39:07 +02:00
parent 542686ffd5
commit 82f946bb36
1 changed files with 5 additions and 0 deletions
--- a/app/src/main/java/org/skinner/RestAPI.java
+++ b/app/src/main/java/org/skinner/RestAPI.java
@ -244,6 +244,11 @@ public class RestAPI extends SafeHttpHandler {
 		}
 		
 		String[] cerd = new String(Base64.getDecoder().decode(authParts[1])).split(":");
+		if (cerd.length != 2) {
+			text(exchange, 401, "Invalid cerdentials format");
+			return;
+		}
+		
 		Profile profile = Database.getProfileByName(cerd[0]);
 		
 		if (profile == null || !Profile.generateHash(cerd[1], profile.getSalt()).equals(profile.getPassword())) {