ginoauth2: use strings.Cut

AlexanderYastrebov · AlexanderYastrebov · commit e9b53d4af893 · 2025-03-06T13:46:14.000+01:00
Use strings.Cut to avoid excessive memory allocation for malicious
requests.

Signed-off-by: Alexander Yastrebov &lt;alexander.yastrebov@zalando.de&gt;
diff --git a/ginoauth2.go b/ginoauth2.go
@@ -107,12 +107,11 @@ func extractToken(r *http.Request) (*oauth2.Token, error) {
 		return nil, errors.New("no authorization header")
 	}
 
-	th := strings.Split(hdr, " ")
-	if len(th) != 2 {
-		return nil, errors.New("incomplete authorization header")
+	typ, token, ok := strings.Cut(hdr, " ")
+	if !ok {
+		return nil, errors.New("invalid authorization header")
 	}
-
-	return &oauth2.Token{AccessToken: th[1], TokenType: th[0]}, nil
+	return &oauth2.Token{AccessToken: token, TokenType: typ}, nil
 }
 
 func requestAuthInfo(o Options, t *oauth2.Token) ([]byte, error) {

Original file line number	Diff line number	Diff line change
`@@ -107,12 +107,11 @@ func extractToken(r http.Request) (oauth2.Token, error) {`
`107`	`107`	`return nil, errors.New("no authorization header")`
`108`	`108`	`}`
`109`	`109`
`110`		`- th := strings.Split(hdr, " ")`
`111`		`- if len(th) != 2 {`
`112`		`- return nil, errors.New("incomplete authorization header")`
	`110`	`+ typ, token, ok := strings.Cut(hdr, " ")`
	`111`	`+ if !ok {`
	`112`	`+ return nil, errors.New("invalid authorization header")`
`113`	`113`	`}`
`114`		`-`
`115`		`- return &oauth2.Token{AccessToken: th[1], TokenType: th[0]}, nil`
	`114`	`+ return &oauth2.Token{AccessToken: token, TokenType: typ}, nil`
`116`	`115`	`}`
`117`	`116`
`118`	`117`	`func requestAuthInfo(o Options, t *oauth2.Token) ([]byte, error) {`