fix: SEC16

src/api/router/auth.rs

@@ -379,6 +379,9 @@ async fn find_token(services: &Services, token: Option<&str>) -> Result<Token> {
 	let Some(token) = token else {
 		return Ok(Token::None);
 	};
+	if token.is_empty() {
+		return Ok(Token::Invalid);
+	}
 
 	let user_token = services.users.find_from_token(token).map_ok(Token::User);
 

src/service/users/mod.rs

@@ -339,6 +339,7 @@ impl Service {
 
 	/// Find out which user an access token belongs to.
 	pub async fn find_from_token(&self, token: &str) -> Result<(OwnedUserId, OwnedDeviceId)> {
+		assert!(!token.is_empty(), "Empty access token");
 		self.db.token_userdeviceid.get(token).await.deserialized()
 	}