Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix JWT claim validation #758

Closed
johakoch opened this issue May 15, 2023 · 1 comment · Fixed by #759
Closed

Fix JWT claim validation #758

johakoch opened this issue May 15, 2023 · 1 comment · Fixed by #759
Assignees
Labels
bug Something isn't working
Milestone

Comments

@johakoch
Copy link
Collaborator

johakoch commented May 15, 2023

Currently (v1.12.1), there are (at least) two flaws in the JWT claim validation.

  1. in validateClaims():
		if val != v {

This panics if the two variables have the same type and the type is uncomparable ([]interface{} or map[string]interface{}).

  1. in getConfiguredClaims()
	claims = seetie.ValueToMap(val)

ValueToMap() creates a string slice for all list/tuple claim values by calling ValueToStringSlice(), regardless of the original type. So e.g.

claims = {
  a = [0, 1, 2]
}

will create []string{"0", "1", "2"}. This may be useful for some uses of seetie.ValueToMap(), but here is doesn't work properly.

@johakoch johakoch added the bug Something isn't working label May 15, 2023
@johakoch
Copy link
Collaborator Author

johakoch commented May 15, 2023

Apart from the JWT required claims, seetie.ValueToMap() is currently used for the following:

in eval/http.go: attributes values

  • set_query_params
  • add_query_params
  • set_form_params
  • add_form_params
  • set_request_headers
  • add_request_headers
  • set_response_headers
  • add_response_headers

in eval/lib/jwt.go: jwt signing config attribute values

  • headers
  • claims

in config/configload/helper.go: jwt signing config attribute values

  • headers

in oauth2/client.go: jwt signing config attribute values

  • headers
  • claims

in handler/transport/oauth2_req_auth.go: jwt signing config attribute values

  • headers
  • claims

I guess that calling ValueToStringSlice() is potentially harmful in all cases apart from those in eval/http.go, where it could be argued to be a sort of user-friendly sanitization for non-string input.

@johakoch johakoch linked a pull request May 17, 2023 that will close this issue
@malud malud closed this as completed in #759 Apr 8, 2024
@johakoch johakoch added this to the 1.13 milestone Apr 19, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants