Aias00 opened a new issue, #6439:
URL: https://github.com/apache/shenyu/issues/6439
### Current Behavior
`JwtPlugin.compatible()` treats any non-empty `Authorization` header
containing `Bearer` as an OAuth-style value and then blindly reads
`finalAuthorization.split(" ")[1]`.
Evidence:
-
`shenyu-plugin/shenyu-plugin-security/shenyu-plugin-jwt/src/main/java/org/apache/shenyu/plugin/jwt/JwtPlugin.java:109`
-
`shenyu-plugin/shenyu-plugin-security/shenyu-plugin-jwt/src/main/java/org/apache/shenyu/plugin/jwt/JwtPlugin.java:113`
```java
return isAuth2(finalAuthorization) ? finalAuthorization.split(" ")[1] :
finalAuthorization;
...
return authorization.contains(AUTH2_TOKEN);
```
Malformed client input such as `Authorization: Bearer` or `Authorization:
fooBearerbar` can throw `ArrayIndexOutOfBoundsException`. Invalid auth input
should be rejected as unauthorized/forbidden, not surface as a server-side 500.
### Expected Behavior
The JWT plugin should only parse a valid `Bearer <token>` format, trim
safely, and reject malformed Authorization headers through the normal plugin
error response path.
### Steps To Reproduce
1. Enable the JWT plugin on a route.
2. Send a request with `Authorization: Bearer`.
3. Observe that `compatible()` attempts to access index `1` from the split
result.
### Affected Code
- `JwtPlugin.compatible()`
- `JwtPlugin.isAuth2()`
### Suggested Fix
Use a strict prefix check such as `startsWith("Bearer ")`, split with a
limit or substring after the prefix, trim the token, and return null/error for
missing token content.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
