SNOW-3704231: Fix externalbrowser auth crash on empty localhost callback socket

The localhost SSO callback loop assumed a single socket read returned the
whole HTTP request:

    int strLen = in.read(buf);
    String[] rets = new String(buf, 0, strLen).split("\r\n");

BufferedReader.read() returns -1 at EOF, i.e. when a socket is accepted but
closed without sending any data. new String(buf, 0, -1) then throws
StringIndexOutOfBoundsException before the real request could be handled.
Browsers routinely open speculative/preconnect sockets to the callback port
and close them without sending data, so the loop crashed on that empty
connection instead of processing the following request carrying the token.

Guard against strLen < 0 and keep listening for the real request.

Adds unit tests covering the empty preconnect connection and a large SSO
request.

Author: sfc-gh-rkowalski

src/main/java/net/snowflake/client/internal/core/SessionUtilExternalBrowser.java

@@ -301,6 +301,15 @@ void authenticate() throws SFException, SnowflakeSQLException {
               new BufferedReader(new InputStreamReader(socket.getInputStream(), UTF8_CHARSET));
           char[] buf = new char[16384];
           int strLen = in.read(buf);
+          if (strLen < 0) {
+            // The browser frequently opens speculative/preconnect sockets to the localhost
+            // callback server and closes them without sending any data. The read then returns -1
+            // (EOF). Previously this produced `new String(buf, 0, -1)` and crashed with
+            // StringIndexOutOfBoundsException before the real request could be handled. Ignore such
+            // empty connections and keep listening. See SNOW-3704231.
+            logger.debug("Received empty request on localhost callback socket. Ignoring.");
+            continue;
+          }
           String[] rets = new String(buf, 0, strLen).split("\r\n");
           if (!processOptions(rets, socket)) {
             processSamlToken(rets, socket);

src/test/java/net/snowflake/client/internal/core/SessionUtilExternalBrowserTest.java

@@ -23,6 +23,7 @@
 import java.sql.ResultSet;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.stream.IntStream;
 import net.snowflake.client.AbstractDriverIT;
 import net.snowflake.client.api.datasource.SnowflakeDataSource;
 import net.snowflake.client.api.datasource.SnowflakeDataSourceFactory;
@@ -260,6 +261,116 @@ public void testInvalidSSOUrl() {
     assertTrue(ex.getMessage().contains("Invalid SSOUrl found"));
   }
 
+  /**
+   * SNOW-3704231: the localhost callback server used to assume a single socket read returned the
+   * whole HTTP request. Browsers routinely open speculative/preconnect sockets to the callback port
+   * and close them without sending any data, so {@code in.read(buf)} returns -1 (EOF) and {@code
+   * new String(buf, 0, -1)} threw StringIndexOutOfBoundsException before the real request was ever
+   * processed. The server must ignore such empty connections and keep listening.
+   *
+   * @throws Throwable if any error occurs
+   */
+  @Test
+  public void testAuthenticateIgnoresEmptyPreconnectSocket() throws Throwable {
+    final SFLoginInput loginInput = initMockLoginInput();
+
+    try (MockedStatic<HttpUtil> mockedHttpUtil = mockStatic(HttpUtil.class)) {
+      mockSsoUrlResponse(mockedHttpUtil);
+
+      // First connection sends no data (browser preconnect closed immediately) -> read() == -1.
+      // Second connection carries the real token.
+      Socket emptySocket = mockSocket(new ByteArrayInputStream(new byte[0]));
+      Socket tokenSocket =
+          mockSocket(
+              toStream(
+                  String.format(
+                      "GET /?token=%s&confirm=1 HTTP/1.1\r\n" + "USER-AGENT: snowflake client",
+                      FakeSessionUtilExternalBrowser.MOCK_SAML_TOKEN)));
+
+      SessionUtilExternalBrowser sub =
+          new SequencedFakeSessionUtilExternalBrowser(
+              loginInput, mockServerSocket(emptySocket, tokenSocket));
+      sub.authenticate();
+      assertEquals(FakeSessionUtilExternalBrowser.MOCK_SAML_TOKEN, sub.getToken());
+    }
+  }
+
+  /**
+   * SNOW-3704231: large SSO requests (big tokens plus Sec-Fetch and Sec-GPC headers) fill the
+   * request line and headers with several kilobytes of data. This confirms the callback server
+   * still parses the token out of such a large request.
+   *
+   * @throws Throwable if any error occurs
+   */
+  @Test
+  public void testAuthenticateHandlesLargeRequest() throws Throwable {
+    final SFLoginInput loginInput = initMockLoginInput();
+
+    try (MockedStatic<HttpUtil> mockedHttpUtil = mockStatic(HttpUtil.class)) {
+      mockSsoUrlResponse(mockedHttpUtil);
+
+      // A large token (mimicking a real SSO token) plus large privacy headers, ~4 KB total.
+      String largeToken = IntStream.range(0, 3000).mapToObj(i -> "A").reduce("", String::concat);
+      String request =
+          String.format(
+              "GET /?token=%s&confirm=1 HTTP/1.1\r\n"
+                  + "USER-AGENT: snowflake client\r\n"
+                  + "Sec-Fetch-Site: none\r\n"
+                  + "Sec-GPC: 1\r\n"
+                  + "\r\n",
+              largeToken);
+
+      Socket socket = mockSocket(toStream(request));
+
+      SessionUtilExternalBrowser sub =
+          new SequencedFakeSessionUtilExternalBrowser(loginInput, mockServerSocket(socket));
+      sub.authenticate();
+      assertEquals(largeToken, sub.getToken());
+    }
+  }
+
+  private static void mockSsoUrlResponse(MockedStatic<HttpUtil> mockedHttpUtil) throws Exception {
+    mockedHttpUtil
+        .when(
+            () ->
+                HttpUtil.executeGeneralRequestWithContext(
+                    Mockito.any(HttpRequestBase.class),
+                    Mockito.anyInt(),
+                    Mockito.anyInt(),
+                    Mockito.anyInt(),
+                    Mockito.anyInt(),
+                    Mockito.anyInt(),
+                    Mockito.nullable(HttpClientSettingsKey.class),
+                    Mockito.nullable(SFBaseSession.class)))
+        .thenReturn(
+            new HttpResponseWithHeaders(
+                "{\"success\":\"true\",\"data\":{\"proofKey\":\""
+                    + MOCK_PROOF_KEY
+                    + "\", \"ssoUrl\":\""
+                    + MOCK_SSO_URL
+                    + "\"}}",
+                new HashMap<>()));
+  }
+
+  private static InputStream toStream(String data) {
+    return new ByteArrayInputStream(data.getBytes(StandardCharsets.UTF_8));
+  }
+
+  private static Socket mockSocket(InputStream in) throws IOException {
+    Socket socket = mock(Socket.class);
+    when(socket.getInputStream()).thenReturn(in);
+    when(socket.getOutputStream())
+        .thenReturn(new FakeSessionUtilExternalBrowser.NullOutputStream());
+    return socket;
+  }
+
+  private static ServerSocket mockServerSocket(Socket first, Socket... rest) throws IOException {
+    ServerSocket serverSocket = mock(ServerSocket.class);
+    when(serverSocket.getLocalPort()).thenReturn(12345);
+    when(serverSocket.accept()).thenReturn(first, rest);
+    return serverSocket;
+  }
+
   /**
    * Mock HttpUtil and SFLoginInput
    *
@@ -319,3 +430,22 @@ public void testExternalBrowserTimeout() throws Exception {
     assertTrue(e.getMessage().contains("External browser authentication failed"));
   }
 }
+
+/**
+ * SessionUtilExternalBrowser whose ServerSocket is supplied by the test, so that the sequence of
+ * accepted connections (e.g. an empty preconnect socket followed by the real request) can be
+ * controlled.
+ */
+class SequencedFakeSessionUtilExternalBrowser extends SessionUtilExternalBrowser {
+  private final ServerSocket serverSocket;
+
+  SequencedFakeSessionUtilExternalBrowser(SFLoginInput loginInput, ServerSocket serverSocket) {
+    super(loginInput, new MockAuthExternalBrowserHandlers());
+    this.serverSocket = serverSocket;
+  }
+
+  @Override
+  protected ServerSocket getServerSocket() {
+    return serverSocket;
+  }
+}