Don't allow empty or null claimName or null value for claim expectations.

This commit is contained in:
Micah Silverman 2015-09-23 01:12:54 -04:00
parent f2e620e36b
commit 5ecaacde5a
2 changed files with 42 additions and 24 deletions

View File

@ -103,9 +103,9 @@ public class DefaultJwtParser implements JwtParser {
@Override
public JwtParser expect(String claimName, Object value) {
if (claimName != null && claimName.length() > 0 && value != null) {
expectedClaims.put(claimName, value);
}
Assert.hasText(claimName, "claim name cannot be null or empty.");
Assert.notNull(value, "The value cannot be null for claim name: " + claimName);
expectedClaims.put(claimName, value);
return this;
}

View File

@ -727,7 +727,7 @@ class JwtParserTest {
}
@Test
void testParseExpectIgnoreNullClaimName() {
void testParseExpectDontAllowNullClaimName() {
def expectedClaimValue = 'A Most Awesome Claim Value'
byte[] key = randomKey()
@ -737,35 +737,47 @@ class JwtParserTest {
setIssuer('Dummy').
compact()
// expecting null claim name, but with value
Jwt<Header, Claims> jwt = Jwts.parser().setSigningKey(key).
expect(null, expectedClaimValue).
parseClaimsJws(compact)
assertEquals jwt.getBody().getIssuer(), 'Dummy'
try {
// expecting null claim name, but with value
Jwt<Header, Claims> jwt = Jwts.parser().setSigningKey(key).
expect(null, expectedClaimValue).
parseClaimsJws(compact)
fail()
} catch (IllegalArgumentException e) {
assertEquals(
"claim name cannot be null or empty.",
e.getMessage()
)
}
}
@Test
void testParseExpectIgnoreEmptyClaimName() {
void testParseExpectDontAllowEmptyClaimName() {
def expectedClaimValue = 'A Most Awesome Claim Value'
byte[] key = randomKey()
// not setting expected claim name in JWT
String compact = Jwts.builder().signWith(SignatureAlgorithm.HS256, key).
setIssuer('Dummy').
compact()
setIssuer('Dummy').
compact()
// expecting null claim name, but with value
Jwt<Header, Claims> jwt = Jwts.parser().setSigningKey(key).
try {
// expecting null claim name, but with value
Jwt<Header, Claims> jwt = Jwts.parser().setSigningKey(key).
expect("", expectedClaimValue).
parseClaimsJws(compact)
assertEquals jwt.getBody().getIssuer(), 'Dummy'
fail()
} catch (IllegalArgumentException e) {
assertEquals(
"claim name cannot be null or empty.",
e.getMessage()
)
}
}
@Test
void testParseExpectIgnoreNullClaimValue() {
void testParseExpectDontAllowNullClaimValue() {
def expectedClaimName = 'A Most Awesome Claim Name'
byte[] key = randomKey()
@ -775,12 +787,18 @@ class JwtParserTest {
setIssuer('Dummy').
compact()
// expecting claim name, but with null value
Jwt<Header, Claims> jwt = Jwts.parser().setSigningKey(key).
expect(expectedClaimName, null).
parseClaimsJws(compact)
assertEquals jwt.getBody().getIssuer(), 'Dummy'
try {
// expecting claim name, but with null value
Jwt<Header, Claims> jwt = Jwts.parser().setSigningKey(key).
expect(expectedClaimName, null).
parseClaimsJws(compact)
fail()
} catch (IllegalArgumentException e) {
assertEquals(
"The value cannot be null for claim name: " + expectedClaimName,
e.getMessage()
)
}
}
@Test