Claim and header checker managers silently keep only the last checker of a claim or header parameter

Abierto
  • ¿Algo no está bien?
#756 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
42/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
php
Área
backend, security

Línea de trabajo

Read the ClaimCheckerManager and HeaderCheckerManager constructors, then trace the library and bundle factory paths and the checker configuration aliases described in the issue. Compare the behavior across the 4.3.x and 5.0.x branches; done means duplicate checker names are reported or rejected as specified for each branch, and the documented one-checker-per-name rule covers bundle configuration.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
Version(s) affected

All released versions since 0.2.0 (3.4.x, 4.0.x, 4.1.x, 4.2.x), and the 4.3.x and 5.0.x branches.

Description

ClaimCheckerManager and HeaderCheckerManager index their checkers by supportedClaim() / supportedHeader(). When two checkers of the list cover the same name, the second one replaces the first, which never runs. Nothing is thrown or logged.

$manager = new ClaimCheckerManager([
    new ExpirationTimeChecker($clock),
    new CallableChecker('exp', $maxLifetime), // at most one hour left to live
]);
$manager->getCheckers(); // ['exp' => CallableChecker]

With this list an expired token passes check(). With the two checkers in the other order, a token valid for ten years passes. No order enforces both rules. Two AudienceCheckers behave the same way. In a header checker manager, the replacement can also drop the protected-only requirement of that parameter.

Every construction path ends in these constructors: the library and bundle factories, jose.checkers.claims / jose.checkers.headers, and the header_checkers of the loaders. In the bundle the lists hold aliases, which do not show the name each checker covers: claims: ['exp', 'iat', 'nbf', 'max_lifetime'], where max_lifetime is a CallableChecker('exp', ...) service, gives a manager without ExpirationTimeChecker. On 4.3.x, the typ: option appends a generated TypeChecker, which replaces any typ checker listed in headers: of the same manager.

Before 0.2.0 the managers refused a second checker for a name (The claim checker "%s" is already supported.). That guard was removed in 387aac8b (November 2017), together with the alias guard of the factories.

Only applications that give one manager two checkers for the same claim or header parameter are concerned. For them, the rule of the replaced checker is not enforced, and nothing tells them.

How to reproduce
$manager = new ClaimCheckerManager([
    new AudienceChecker('api'),
    new AudienceChecker('tenant-42'),
]);
$manager->check(['aud' => ['other', 'tenant-42']]); // passes: the "api" checker never runs
Possible Solution
  • 4.3.0: trigger a deprecation in both constructors when a name is already covered by a different checker instance (the same instance listed twice stays silent), and keep the current behaviour.
  • 5.0.0: throw an InvalidArgumentException.
  • Document that a manager takes one checker per claim or header parameter, and that several rules on one claim belong in one checker.
Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-YWJFJRRB).

Lenguaje dominante
PHP
Estrellas
954
Forks
119
Merge medio
48 min
PR fusionados (30 d)
17

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de web-token/jwt-framework

Todos los issues de web-token/jwt-framework

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.