From: Tobias Markmann <tm@ayena.de>
Date: Sat, 22 May 2010 12:47:21 +0000 (+0200)
Subject: util.sasl.scram: Parsing client-final-message in a more strict way.  (thanks Marc... 
X-Git-Url: https://git.enpas.org/?a=commitdiff_plain;h=3096231f827218ad8d5599ab192d647e4ec8b5f5;hp=0aa56b2958855a0c83dd711d880e404b1a02e2c7;p=prosody.git

util.sasl.scram: Parsing client-final-message in a more strict way.  (thanks Marc Santamaria)
---

diff --git a/util/sasl/scram.lua b/util/sasl/scram.lua
index 7b9123ee..0188d5cf 100644
--- a/util/sasl/scram.lua
+++ b/util/sasl/scram.lua
@@ -153,10 +153,7 @@ local function scram_gen(hash_name, H_f, HMAC_f)
 			-- we are processing client_final_message
 			local client_final_message = message;
 			
-			-- TODO: more strict parsing of client_final_message
-			self.state["proof"] = client_final_message:match("p=(.+)");
-			self.state["nonce"] = client_final_message:match("r=(.+),p=");
-			self.state["channelbinding"] = client_final_message:match("c=(.+),r=");
+			self.state["channelbinding"], self.state["nonce"], self.state["proof"] = client_final_message:match("^c=(.*),r=(.*),.*p=(.*)");
 	
 			if not self.state.proof or not self.state.nonce or not self.state.channelbinding then
 				return "failure", "malformed-request", "Missing an attribute(p, r or c) in SASL message.";