[3.x] Fix bearer token format validation

src/Guard.php

@@ -117,7 +117,30 @@ protected function getTokenFromRequest(Request $request)
             return (string) (Sanctum::$accessTokenRetrievalCallback)($request);
         }
 
-        return $request->bearerToken();
+        $token = $request->bearerToken();
+
+        return $this->isValidBearerToken($token) ? $token : null;
+    }
+
+    /**
+     * Determine if the bearer token is in the correct format.
+     *
+     * @param  string|null  $token
+     * @return bool
+     */
+    protected function isValidBearerToken(string $token = null)
+    {
+        if (! is_null($token) && str_contains($token, '|')) {
+            $model = new Sanctum::$personalAccessTokenModel;
+
+            if ($model->getKeyType() === 'int') {
+                [$id, $token] = explode('|', $token, 2);
+
+                return ctype_digit($id) && ! empty($token);
+            }
+        }
+
+        return ! empty($token);
     }
 
     /**

tests/GuardTest.php

@@ -284,6 +284,48 @@ public function test_authentication_with_token_fails_if_user_provider_is_invalid
         Event::assertNotDispatched(TokenAuthenticated::class);
     }
 
+    /**
+     * @dataProvider invalidTokenDataProvider
+     */
+    public function test_authentication_with_token_fails_if_token_has_invalid_format($invalidToken)
+    {
+        $this->loadLaravelMigrations(['--database' => 'testbench']);
+        $this->artisan('migrate', ['--database' => 'testbench'])->run();
+
+        $factory = Mockery::mock(AuthFactory::class);
+
+        $guard = new Guard($factory, null, 'users');
+
+        $webGuard = Mockery::mock(stdClass::class);
+
+        $factory->shouldReceive('guard')
+            ->with('web')
+            ->andReturn($webGuard);
+
+        $webGuard->shouldReceive('user')->once()->andReturn(null);
+
+        $request = Request::create('/', 'GET');
+
+        $user = User::forceCreate([
+            'name' => 'Taylor Otwell',
+            'email' => 'taylor@laravel.com',
+            'password' => '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi',
+            'remember_token' => Str::random(10),
+        ]);
+
+        PersonalAccessToken::forceCreate([
+            'tokenable_id' => $user->id,
+            'tokenable_type' => get_class($user),
+            'name' => 'Test',
+            'token' => hash('sha256', 'test'),
+            'expires_at' => now()->subMinutes(60),
+        ]);
+
+        $request->headers->set('Authorization', $invalidToken);
+        $returnedUser = $guard->__invoke($request);
+        $this->assertNull($returnedUser);
+    }
+
     public function test_authentication_is_successful_with_token_if_user_provider_is_valid()
     {
         $this->loadLaravelMigrations(['--database' => 'testbench']);
@@ -499,6 +541,24 @@ protected function getPackageProviders($app)
     {
         return [SanctumServiceProvider::class];
     }
+
+    public function invalidTokenDataProvider(): array
+    {
+        return [
+            [''],
+            ['|'],
+            ['test'],
+            ['|test'],
+            ['1ABC|test'],
+            ['1ABC|'],
+            ['1,2|test'],
+            ['Bearer'],
+            ['Bearer |test'],
+            ['Bearer 1,2|test'],
+            ['Bearer 1ABC|test'],
+            ['Bearer 1ABC|'],
+        ];
+    }
 }
 
 class User extends Model implements HasApiTokensContract