Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-11-10 11:39:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix sensitive case in JwtTypeValidator

Browse Source 
Closes gh-18092

Signed-off-by: namest504 <namest504@gmail.com>
This commit is contained in:
namest504 2025-10-24 15:49:10 +09:00 committed by Josh Cummings
parent f548aaf5c5
commit 6501e97ece
2 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/JwtTypeValidator.java
View File

@ -72,9 +72,11 @@ public final class JwtTypeValidator implements OAuth2TokenValidator<Jwt> {
if (this.allowEmpty && !StringUtils.hasText(typ)) { if (this.allowEmpty && !StringUtils.hasText(typ)) {
return OAuth2TokenValidatorResult.success(); return OAuth2TokenValidatorResult.success();
} }
if (this.validTypes.contains(typ)) { for (String validType : this.validTypes) {
if (validType.equalsIgnoreCase(typ)) {
return OAuth2TokenValidatorResult.success(); return OAuth2TokenValidatorResult.success();
} }
}
return OAuth2TokenValidatorResult.failure(new OAuth2Error(OAuth2ErrorCodes.INVALID_TOKEN, return OAuth2TokenValidatorResult.failure(new OAuth2Error(OAuth2ErrorCodes.INVALID_TOKEN,
"the given typ value needs to be one of " + this.validTypes, "the given typ value needs to be one of " + this.validTypes,
"https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.9")); "https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.9"));

8
oauth2/oauth2-jose/src/test/java/org/springframework/security/oauth2/jwt/JwtTypeValidatorTests.java
View File

@ -44,4 +44,12 @@ class JwtTypeValidatorTests {
assertThat(validator.validate(jwt.build()).hasErrors()).isFalse(); assertThat(validator.validate(jwt.build()).hasErrors()).isFalse();
} }
@Test
void validateWhenTypHeaderHasDifferentCaseThenSuccess() {
Jwt.Builder jwt = TestJwts.jwt();
JwtTypeValidator validator = new JwtTypeValidator("at+jwt");
jwt.header(JoseHeaderNames.TYP, "AT+JWT");
assertThat(validator.validate(jwt.build()).hasErrors()).isFalse();
}
} }