fix: drop a sub claim carrying CR, LF or NUL

src/oauth.test.ts

@@ -23,4 +23,12 @@ describe("xAI oauth — user id decoding", () => {
       xaiUserIdFromAccessToken(jwtWithPayload({ sub: 123 })),
     ).toBeUndefined();
   });
+
+  test("treats a sub carrying CR, LF or NUL as absent", () => {
+    for (const bad of ["u\r\nx-grok-user-id: victim", "u\nx", "u\u0000x"]) {
+      expect(
+        xaiUserIdFromAccessToken(jwtWithPayload({ sub: bad })),
+      ).toBeUndefined();
+    }
+  });
 });

src/oauth.ts

@@ -93,5 +93,10 @@ export function xaiUserIdFromAccessToken(access: string): string | undefined {
     return undefined;
   }
   const payload = AccessTokenPayload(decoded);
-  return payload instanceof type.errors ? undefined : payload.sub;
+  if (payload instanceof type.errors) return undefined;
+  // The sub becomes a request header value; CR, LF or NUL would split or
+  // truncate it, so such a claim is treated as absent.
+  return payload.sub === undefined || /[\r\n\0]/.test(payload.sub)
+    ? undefined
+    : payload.sub;
 }