isJWT function returning true for invalid JWT tokens with 2 parts

[Prathamesh061]

The function isJWT returns true for an invalid JWT token that has only 2 parts.

This is because the len variable is checked to be less than 2, but it should be less than 3 since a valid JWT token has 3 parts separated by dots.

So, to fix the bug, the if condition should be changed from:

if (len > 3 || len < 2) {

to:

if (len !== 3) {

This will ensure that the function only returns true for valid JWT tokens with exactly 3 parts, and false for everything else.

How to reproduce the issue

invalid token = eyJpZCI6IjY0MzgyNzgzZTQ5M2JhMjMzNmY3NTRiNSIsInVzZXJJZCI6InByYXRoYW0wNiIsInJvbGUiOiJVU0VSIiwiaWF0IjoxNjgxNDAxOTQ1LCJleHAiOjE2ODE0ODgzNDV9.R7Bd8zo48onJiB8gQiZlTbwIwfP9lLzMzAAPCSx_TDg
validate this invalid it will return true

[pano9000]

PR can be found here: #2217

[pano9000]

closed by 3507d27