JsonWebToken constructor doesn't count JWT segments properly

[mafurman]

azure-activedirectory-identitymodel-extensions-for-dotnet/src/Microsoft.IdentityModel.JsonWebTokens/JsonWebToken.cs

Lines 54 to 76 in 110ced7

	public JsonWebToken(string jwtEncodedString)
	{
	if (string.IsNullOrEmpty(jwtEncodedString))
	throw new ArgumentNullException(nameof(jwtEncodedString));
	int count = 1;
	int next = -1;
	while ((next = jwtEncodedString.IndexOf('.', next + 1)) != -1)
	{
	count++;
	if (count >= JwtConstants.JwsSegmentCount)
	break;
	}
	// JWS or JWE
	if (count == JwtConstants.JwsSegmentCount || count == JwtConstants.JweSegmentCount)
	{
	var tokenParts = jwtEncodedString.Split('.');
	Decode(tokenParts, jwtEncodedString);
	}
	else
	throw LogHelper.LogExceptionMessage(new ArgumentException(LogHelper.FormatInvariant(LogMessages.IDX14100, jwtEncodedString)));
	}

As soon as 'count' gets to JwtConstants.JwsSegmentCount (3), the while loop will terminate. This means that as long as the number of dots in the 'jwtEncodedString' is >= 2, the value of 'count' will always be equal to 3. This also means that we'll split the string and try to decode it even if it isn't a properly formatted JWT token.