Validate token from ACME server

Validate that the token includes only characters from
the base64url alphabet as specified by RCF8555.

Fixes #64

uacme.c

@@ -865,6 +865,11 @@ bool authorize(acme_t *a)
                     warnx("failed to parse challenge");
                     goto out;
                 }
+                for (const char *t = token; *t; t++)
+                    if (!isalnum(*t) && *t != '-' && *t != '_') {
+                        warnx("failed to validate token");
+                        goto out;
+                    }
                 if (strcmp(type, "dns-01") == 0 ||
                         strcmp(type, "tls-alpn-01") == 0)
                     key_auth = sha2_base64url(256, "%s.%s", token, thumbprint);