Fix possible overflow - thanks @eutychus

@eutychus contributed this fix that checks to make sure that the Authorization header contains at least "Bearer: "

Author: fitzyjoe

src/ngx_http_auth_jwt_module.c

@@ -413,6 +413,7 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 	char* jwtCookieValChrPtr = NULL;
 	ngx_str_t jwtCookieVal;
 	ngx_int_t n;
+	ngx_int_t bearer_length;
 	ngx_str_t authorizationHeaderStr;
 
 	ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "auth_jwt_validation_type.len %d", auth_jwt_validation_type.len);
@@ -425,12 +426,17 @@ static char * getJwt(ngx_http_request_t *r, ngx_str_t auth_jwt_validation_type)
 		{
 			ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Found authorization header len %d", authorizationHeader->value.len);
 
-			authorizationHeaderStr.data = authorizationHeader->value.data + sizeof("Bearer ") - 1;
-			authorizationHeaderStr.len = authorizationHeader->value.len - (sizeof("Bearer ") - 1);
+			bearer_length = authorizationHeader->value.len - (sizeof("Bearer ") - 1);
 
-			jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
+			if (bearer_length > 0) 
+			{
+				authorizationHeaderStr.data = authorizationHeader->value.data + sizeof("Bearer ") - 1;
+				authorizationHeaderStr.len = bearer_length;
+
+				jwtCookieValChrPtr = ngx_str_t_to_char_ptr(r->pool, authorizationHeaderStr);
 
-			ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Authorization header: %s", jwtCookieValChrPtr);
+				ngx_log_error(NGX_LOG_DEBUG, r->connection->log, 0, "Authorization header: %s", jwtCookieValChrPtr);
+			}
 		}
 	}
 	else if (auth_jwt_validation_type.len > sizeof("COOKIE=") && ngx_strncmp(auth_jwt_validation_type.data, "COOKIE=", sizeof("COOKIE=") - 1)==0)

test.sh

@@ -36,6 +36,8 @@ main() {
 
   test_jwt "Secure test without jwt auth header" "/secure-auth-header/" "302"
 
+  test_jwt "Secure test with jwt auth header missing Bearer" "/secure-no-redirect/" "401" "--header \"Authorization: X\""
+
   test_jwt "Secure test without jwt auth header" "/secure-no-redirect/" "401"
 
   test_jwt "Secure test with jwt cookie - with no sub" "/secure/" "200" " --cookie \"rampartjwt=${MISSING_SUB_JWT}\""
@@ -45,4 +47,4 @@ main() {
   test_jwt "Secure test with rs256 jwt cookie" "/secure-rs256/" "200" " --cookie \"rampartjwt=${VALID_RS256_JWT}\""
 }
 
-main "$@"
+main "$@"