honeymoose
/
jjwt
mirror of https://github.com/jwtk/jjwt.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Ensured JCA Name comparison is not case sensitive per Java Security Standard Algorithm Names documentation. Accompanied with test case for regression. 

Resolves #381
This commit is contained in:
Les Hazlewood 2018-08-14 11:41:19 -04:00
parent a4b388cd2e
commit 56b3a71733
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java
View File

@ -349,7 +349,11 @@ public enum SignatureAlgorithm {
if (alg == null) {
throw new InvalidKeyException("The " + keyType(signing) + " key's algorithm cannot be null.");
}
if (!HS256.jcaName.equals(alg) && !HS384.jcaName.equals(alg) && !HS512.jcaName.equals(alg)) {
// These next checks use equalsIgnoreCase per https://github.com/jwtk/jjwt/issues/381#issuecomment-412912272
if (!HS256.jcaName.equalsIgnoreCase(alg) &&
!HS384.jcaName.equalsIgnoreCase(alg) &&
!HS512.jcaName.equalsIgnoreCase(alg)) {
throw new InvalidKeyException("The " + keyType(signing) + " key's algorithm '" + alg +
"' does not equal a valid HmacSHA* algorithm name and cannot be used with " + name() + ".");
}

19
api/src/test/groovy/io/jsonwebtoken/SignatureAlgorithmTest.groovy
View File

@ -372,6 +372,25 @@ class SignatureAlgorithmTest {
}
}
@Test // https://github.com/jwtk/jjwt/issues/381
void testAssertValidHmacSigningKeyCaseInsensitiveJcaName() {
for (SignatureAlgorithm alg : SignatureAlgorithm.values().findAll { it.isHmac() }) {
SecretKey key = createMock(SecretKey)
int numBits = alg.minKeyLength
int numBytes = numBits / 8 as int
expect(key.getEncoded()).andReturn(new byte[numBytes])
expect(key.getAlgorithm()).andReturn(alg.jcaName.toUpperCase()) // <-- upper case, non standard JCA name
replay key
alg.assertValidSigningKey(key)
verify key
}
}
@Test
void testAssertValidHmacSigningKeyUnsupportedAlgorithm() {