fix #2801 Updated AccessTokenHelper to throw exception when only 'Bearer' is specified in Authorization header

src/main/java/org/codelibs/fess/helper/AccessTokenHelper.java

@@ -27,6 +27,8 @@ import org.codelibs.fess.util.ComponentUtil;
 
 public class AccessTokenHelper {
 
+    protected static final String BEARER = "Bearer";
+
     protected Random random = new SecureRandom();
 
     public String generateAccessToken() {
@@ -37,10 +39,10 @@ public class AccessTokenHelper {
         final String token = request.getHeader("Authorization");
         if (token != null) {
             final String[] values = token.trim().split(" ");
-            if (values.length == 2 && "Bearer".equals(values[0])) {
+            if (values.length == 2 && BEARER.equals(values[0])) {
                 return values[1];
             }
-            if (values.length == 1) {
+            if (values.length == 1 && !BEARER.equals(values[0])) {
                 return values[0];
             }
             throw new InvalidAccessTokenException("invalid_request", "Invalid format: " + token);

src/test/java/org/codelibs/fess/helper/AccessTokenHelperTest.java

@@ -63,16 +63,22 @@ public class AccessTokenHelperTest extends UnitFessTestCase {
         assertEquals(token, accessTokenHelper.getAccessTokenFromRequest(req));
     }
 
-    public void test_getAccessTokenFromRequest_ng0() {
-        final String token = accessTokenHelper.generateAccessToken();
+    public void test_getAccessTokenFromRequest_bad0() {
         MockletHttpServletRequest req = getMockRequest();
         assertNull(accessTokenHelper.getAccessTokenFromRequest(req));
     }
 
-    public void test_getAccessTokenFromRequest_ng1() {
+    public void test_getAccessTokenFromRequest_bad1() {
         final String token = "INVALID _TOKEN0";
         MockletHttpServletRequest req = getMockRequest();
         req.addHeader("Authorization", token);
         assertThrows(InvalidAccessTokenException.class, () -> accessTokenHelper.getAccessTokenFromRequest(req));
     }
+
+    public void test_getAccessTokenFromRequest_bad2() {
+        final String token = "Bearer";
+        MockletHttpServletRequest req = getMockRequest();
+        req.addHeader("Authorization", token);
+        assertThrows(InvalidAccessTokenException.class, () -> accessTokenHelper.getAccessTokenFromRequest(req));
+    }
 }