validate bearer scheme in get_bearer_token_auth (#2544)

test/test.cc

@@ -1560,6 +1560,34 @@ TEST(GetHeaderValueTest, RegularInvalidValueInt) {
   EXPECT_TRUE(is_invalid_value);
 }
 
+TEST(BearerTokenAuthTest, SchemeValidation) {
+  // A value shorter than "Bearer " must not throw from the fixed-length
+  // substr, and a non-Bearer scheme must not be reported as a token.
+  {
+    Request req;
+    req.set_header("Authorization", "x");
+    EXPECT_EQ("", get_bearer_token_auth(req));
+  }
+  {
+    Request req;
+    req.set_header("Authorization", "Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==");
+    EXPECT_EQ("", get_bearer_token_auth(req));
+  }
+
+  // A well-formed header still yields the token; the scheme is
+  // case-insensitive.
+  {
+    Request req;
+    req.set_header("Authorization", "Bearer abc123");
+    EXPECT_EQ("abc123", get_bearer_token_auth(req));
+  }
+  {
+    Request req;
+    req.set_header("Authorization", "bearer abc123");
+    EXPECT_EQ("abc123", get_bearer_token_auth(req));
+  }
+}
+
 TEST(GetHeaderValueTest, OutOfRangeValueInt) {
   // An all-digit value that overflows size_t must be reported as invalid, not
   // silently saturated/truncated: parsing at size_t width would otherwise wrap