fix(06-12): reject typed-nil guards and fractional JWT subjects

bouncer/jwt.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"math"
 	"net/http"
 	"strconv"
 	"strings"
@@ -148,12 +149,16 @@ func subject(claims jwt.MapClaims) string {
 	case string:
 		return strings.TrimSpace(v)
 	case float64:
-		if v <= 0 {
+		if math.IsNaN(v) || math.IsInf(v, 0) || v <= 0 || v != math.Trunc(v) || v > 9007199254740992 {
 			return ""
 		}
 		return strconv.FormatInt(int64(v), 10)
 	case json.Number:
-		return strings.TrimSpace(v.String())
+		n, err := strconv.ParseInt(strings.TrimSpace(v.String()), 10, 64)
+		if err != nil || n <= 0 {
+			return ""
+		}
+		return strconv.FormatInt(n, 10)
 	default:
 		return ""
 	}