reject control characters in bearer token in BearerScheme

httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/BearerScheme.java

@@ -160,7 +160,13 @@ public String generateAuthResponse(
             final HttpRequest request,
             final HttpContext context) throws AuthenticationException {
         Asserts.notNull(bearerToken, "Bearer token");
-        return StandardAuthScheme.BEARER + " " + bearerToken.getToken();
+        final String token = bearerToken.getToken();
+        for (int i = 0; i < token.length(); i++) {
+            if (Character.isISOControl(token.charAt(i))) {
+                throw new AuthenticationException("Bearer token must not contain any control characters");
+            }
+        }
+        return StandardAuthScheme.BEARER + " " + token;
     }
 
     @Override

httpclient5/src/test/java/org/apache/hc/client5/http/impl/auth/TestBearerScheme.java

@@ -29,6 +29,7 @@
 import org.apache.hc.client5.http.auth.AuthChallenge;
 import org.apache.hc.client5.http.auth.AuthScheme;
 import org.apache.hc.client5.http.auth.AuthScope;
+import org.apache.hc.client5.http.auth.AuthenticationException;
 import org.apache.hc.client5.http.auth.BearerToken;
 import org.apache.hc.client5.http.auth.ChallengeType;
 import org.apache.hc.client5.http.auth.CredentialsProvider;
@@ -74,6 +75,25 @@ void testBearerAuthentication() throws Exception {
         Assertions.assertFalse(authscheme.isConnectionBased());
     }
 
+    @Test
+    void testBearerTokenWithControlCharacters() throws Exception {
+        final AuthChallenge authChallenge = new AuthChallenge(ChallengeType.TARGET, "Bearer",
+                new BasicNameValuePair("realm", "test"));
+
+        final AuthScheme authscheme = new BearerScheme();
+        authscheme.processChallenge(authChallenge, null);
+
+        final HttpHost host = new HttpHost("somehost", 80);
+        final CredentialsProvider credentialsProvider = CredentialsProviderBuilder.create()
+                .add(new AuthScope(host, "test", null), new BearerToken("token\r\nX-Injected: evil"))
+                .build();
+
+        final HttpRequest request = new BasicHttpRequest("GET", "/");
+        Assertions.assertTrue(authscheme.isResponseReady(host, credentialsProvider, null));
+        Assertions.assertThrows(AuthenticationException.class,
+                () -> authscheme.generateAuthResponse(host, request, null));
+    }
+
     @Test
     void testStateStorage() throws Exception {
         final AuthChallenge authChallenge = new AuthChallenge(ChallengeType.TARGET, "Bearer",