From 9ea25a8b9933743e7a917bc86b228c8480778917 Mon Sep 17 00:00:00 2001
From: Keegan Caruso <keegancaruso@microsoft.com>
Date: Fri, 26 Jan 2024 15:04:25 -0800
Subject: [PATCH] Use InvariantCulture for collections as well

#2453 was incomplete

Fixes #2409
---
 .../JwtPayload.cs                             |  8 ++++++-
 .../JsonWebTokenTests.cs                      | 23 +++++++++++++++----
 .../JwtSecurityTokenTests.cs                  | 14 +++++++----
 3 files changed, 35 insertions(+), 10 deletions(-)

diff --git a/src/System.IdentityModel.Tokens.Jwt/JwtPayload.cs b/src/System.IdentityModel.Tokens.Jwt/JwtPayload.cs
index 01e9f76e14..91b5722bf0 100644
--- a/src/System.IdentityModel.Tokens.Jwt/JwtPayload.cs
+++ b/src/System.IdentityModel.Tokens.Jwt/JwtPayload.cs
@@ -563,7 +563,13 @@ private void AddListofObjects(string key, IEnumerable<object> objects, List<Clai
                 else if (obj is IEnumerable<object> innerObjects)
                     AddListofObjects(key, innerObjects, claims, issuer);
                 else
-                    claims.Add(new Claim(key, obj.ToString(), GetClaimValueType(obj), issuer, issuer));
+                {
+                    var claimValueType = GetClaimValueType(obj);
+                    if (obj is IFormattable formattable)
+                        claims.Add(new Claim(key, formattable.ToString(null, CultureInfo.InvariantCulture), claimValueType, issuer, issuer));
+                    else
+                        claims.Add(new Claim(key, obj.ToString(), claimValueType, issuer, issuer));
+                }
             }
         }
 
diff --git a/test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenTests.cs b/test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenTests.cs
index 6d70531ea8..51c901c1e2 100644
--- a/test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenTests.cs
+++ b/test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenTests.cs
@@ -1635,20 +1635,35 @@ public void EscapedClaims()
         [Fact]
         public void DifferentCultureJsonWebToken()
         {
-            string result = string.Empty;
+            string numericClaim = string.Empty;
+            List<Claim> numericList = null;
 
             var thread = new Thread(() =>
             {
                 CultureInfo.CurrentCulture = new CultureInfo("fr-FR");
-                var token = new JsonWebToken(JsonUtilities.CreateUnsignedToken("numericClaim", 10.9d));
+
+                var handler = new JsonWebTokenHandler();
+                var tokenStr = handler.CreateToken(new SecurityTokenDescriptor
+                {
+                    Claims = new Dictionary<string, object>
+                    {
+                        { "numericClaim", 10.9d },
+                        { "numericList", new List<object> { 12.2, 11.1 } }
+                    }
+                });
+
+                var token = new JsonWebToken(tokenStr);
                 var claim = token.Claims.First(c => c.Type == "numericClaim");
-                result = claim.Value;
+                numericClaim = claim.Value;
+                numericList = token.Claims.Where(c => c.Type == "numericList").ToList();
             });
 
             thread.Start();
             thread.Join();
 
-            Assert.Equal("10.9", result);
+            Assert.Equal("10.9", numericClaim);
+            Assert.Equal("12.2", numericList[0].Value);
+            Assert.Equal("11.1", numericList[1].Value);
         }
     }
 
diff --git a/test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenTests.cs b/test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenTests.cs
index f2467c8b2c..3bffca32e5 100644
--- a/test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenTests.cs
+++ b/test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenTests.cs
@@ -459,7 +459,8 @@ public static TheoryData<JwtTheoryData> JwtSegmentTheoryData
         [Fact]
         public void DifferentCultureJwtSecurityToken()
         {
-            string result = string.Empty;
+            string numericClaim = string.Empty;
+            List<Claim> numericList = null;
 
             var thread = new Thread(() =>
             {
@@ -470,19 +471,22 @@ public void DifferentCultureJwtSecurityToken()
                 {
                     Claims = new Dictionary<string, object>
                     {
-                        { "numericClaim", 10.9d }
+                        { "numericClaim", 10.9d },
+                        { "numericList", new List<object> { 12.2, 11.1 } }
                     }
                 });
 
                 var claim = token.Claims.First(c => c.Type == "numericClaim");
-                result = claim.Value;
-
+                numericClaim = claim.Value;
+                numericList = token.Claims.Where(c => c.Type == "numericList").ToList();
             });
 
             thread.Start();
             thread.Join();
 
-            Assert.Equal("10.9", result);
+            Assert.Equal("10.9", numericClaim);
+            Assert.Equal("12.2", numericList[0].Value);
+            Assert.Equal("11.1", numericList[1].Value);
         }
     }
 }