Reject BASIC auth with empty user name

Author: markt-asf

java/org/apache/catalina/authenticator/BasicAuthenticator.java

@@ -243,6 +243,8 @@ private void parseCredentials(byte[] decoded) throws IllegalArgumentException {
             // Null password is not allowed according to RFC 7617
             if (colon < 0) {
                 throw new IllegalArgumentException(sm.getString("basicAuthenticator.noColon"));
+            } else if (colon == 0) {
+                throw new IllegalArgumentException(sm.getString("basicAuthenticator.emptyUsername"));
             } else {
                 username = new String(decoded, 0, colon, charset);
                 password = new String(decoded, colon + 1, decoded.length - colon - 1, charset);

java/org/apache/catalina/authenticator/LocalStrings.properties

@@ -39,6 +39,7 @@ authenticator.unauthorized=Cannot authenticate with the provided credentials
 authenticator.userDataPermissionFail=User data does not comply with the constraints of the resource
 authenticator.userPermissionFail=User [{0}] does not have authorization to access the resource
 
+basicAuthenticator.emptyUsername=RFC 7613 does not permit empty user names
 basicAuthenticator.invalidAuthorization=Invalid Authorization header
 basicAuthenticator.invalidCharset=The only permitted values are null, the empty string or UTF-8
 basicAuthenticator.noColon=Basic Authorization credentials do not contain a colon

test/org/apache/catalina/authenticator/TestBasicAuthParser.java

@@ -165,14 +165,12 @@ public void testWrongPassword() throws Exception {
         Assert.assertNotSame(PASSWORD, credentials.getPassword());
     }
 
-    @Test
+    @Test(expected = IllegalArgumentException.class)
     public void testMissingUsername() throws Exception {
         final String EMPTY_USER_NAME = "";
         final BasicAuthHeader AUTH_HEADER = new BasicAuthHeader(NICE_METHOD, EMPTY_USER_NAME, PASSWORD);
         BasicAuthenticator.BasicCredentials credentials =
                 new BasicAuthenticator.BasicCredentials(AUTH_HEADER.getHeader(), StandardCharsets.UTF_8);
-        Assert.assertEquals(EMPTY_USER_NAME, credentials.getUsername());
-        Assert.assertEquals(PASSWORD, credentials.getPassword());
     }
 
     @Test

webapps/docs/changelog.xml

@@ -221,6 +221,10 @@
         Reject BASIC authorization with no password, to comply with RFC 7617
         strictly. (remm)
       </fix>
+      <fix>
+        Reject BASIC authorization with empty user names as required by RFC
+        7613. (markt)
+      </fix>
       <!-- Entries for backport and removal before 12.0.0-M1 below this line -->
       <fix>
         Avoid a race condition with concurrent lookups for a singleton JNDI