honeymoose
/
jjwt
mirror of https://github.com/jwtk/jjwt.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #105 from aarondav/patch-2 

Avoid potentially critical vulnerability in ECDSA signature validation
This commit is contained in:
Les Hazlewood 2016-07-04 11:56:48 -07:00 committed by GitHub
parent 8e6e165c1d 707f7bc046
commit e55ea34e95
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/main/java/io/jsonwebtoken/impl/DefaultJwtParser.java
View File

@ -319,8 +319,8 @@ public class DefaultJwtParser implements JwtParser {
if (!Objects.isEmpty(keyBytes)) { if (!Objects.isEmpty(keyBytes)) {
Assert.isTrue(!algorithm.isRsa(), Assert.isTrue(algorithm.isHmac(),
"Key bytes cannot be specified for RSA signatures. Please specify a PublicKey or PrivateKey instance."); "Key bytes can only be specified for HMAC signatures. Please specify a PublicKey or PrivateKey instance.");
key = new SecretKeySpec(keyBytes, algorithm.getJcaName()); key = new SecretKeySpec(keyBytes, algorithm.getJcaName());
} }