Verify JWT header format #622
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
304
force-pushed
the
fix_invalid_header_format
branch
2 times, most recently
from
d96643b
to
abd8816
Compare
anakinj
requested changes
Sep 30, 2024
lib/jwt/decode.rb
Outdated
| @@ -135,7 +135,7 @@ def decode_signature | |||
| end | |||
|
|
|||
| def alg_in_header | |||
| header['alg'] | |||
| header.is_a?(Hash) && header['alg'] | |||
There was a problem hiding this comment.
I would maybe like to have the type concern separated from checking the alg value.
For example a separate guard in #verify_algo
def verify_algo
raise JWT::IncorrectAlgorithm, 'An algorithm must be specified' if allowed_algorithms.empty?
raise JWT::DecodeError, 'Token header not a JSON object' unless header.is_a?(Hash)
raise JWT::IncorrectAlgorithm, 'Token is missing alg header' unless alg_in_header
raise JWT::IncorrectAlgorithm, 'Expected a different algorithm' if allowed_and_valid_algorithms.empty?
end
There was a problem hiding this comment.
Good idea @anakinj! 👍 Thank you, I've applied your suggestion.
|
This change is also a fix to #470 |
**Problem** JWT header is expected to be a hash. However, it's possible to generate a token that defines header as an Array `[]`. This case is not handled by the application and leads to `TypeError: no implicit conversion of String into Integer`. **Solution** Add a verification for an header type before accessing hash elements.
304
force-pushed
the
fix_invalid_header_format
branch
from
abd8816
to
5767e79
Compare
anakinj
approved these changes
Sep 30, 2024
|
Great work. Thanks @304 for the effort. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
JWT header is expected to be a hash. However, it's possible to generate a token that defines header as an Array
[]. This case is not handled by the application and leads toTypeError: no implicit conversion of String into Integer.Solution
Add a verification for an header type before accessing hash elements.
Checklist
Before the PR can be merged be sure the following are checked: