Merge pull request #35 from sisk-http/codex/propose-fix-for-log-download-vulnerability

fix(monitoring): reject malformed Basic auth headers

Author: CypherPotato

extensions/Sisk.Monitoring/ApplicationMonitor.cs

@@ -1118,7 +1118,13 @@ class AuthorizationRequestHandler ( ApplicationMonitor monitor ) : IRequestHandl
             }
 
             string encodedCredentials = authorization [ "Basic ".Length.. ];
-            string decodedCredentials = System.Text.Encoding.UTF8.GetString ( Convert.FromBase64String ( encodedCredentials ) );
+            string decodedCredentials;
+            try {
+                decodedCredentials = System.Text.Encoding.UTF8.GetString ( Convert.FromBase64String ( encodedCredentials ) );
+            }
+            catch (FormatException) {
+                return UnauthorizedResponse;
+            }
 
             int separatorIndex = decodedCredentials.IndexOf ( ':' );
             if (separatorIndex < 0) {