Catch IllegalArgumentException when decoding base64

Signed-off-by: Florian Hotze <[email protected]>
openhab · Dec 31, 2024 · f8eccec · f8eccec
1 parent 164291a
commit f8eccec
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/...core.io.websocket/src/main/java/org/openhab/core/io/websocket/CommonWebSocketServlet.java b/...core.io.websocket/src/main/java/org/openhab/core/io/websocket/CommonWebSocketServlet.java
@@ -121,7 +121,13 @@ private class CommonWebSocketCreator implements WebSocketCreator {
                 Matcher matcher = WEBSOCKET_ACCESS_TOKEN_PATTERN.matcher(secWebSocketProtocolHeader);
                 if (matcher.find() && matcher.group("base64") != null) {
                     String base64 = matcher.group("base64");
-                    accessToken = new String(Base64.getDecoder().decode(base64));
+                    try {
+                        accessToken = new String(Base64.getDecoder().decode(base64));
+                    } catch (IllegalArgumentException e) {
+                        logger.warn("Invalid base64 encoded access token in Sec-WebSocket-Protocol header from {}.",
+                                servletUpgradeRequest.getRemoteAddress());
+                        return null;
+                    }
                 } else {
                     logger.warn("Invalid use of Sec-WebSocket-Protocol header from {}.",
                             servletUpgradeRequest.getRemoteAddress());