X5UFactory: an x5u entry can name a local file

Abierto
  • ¿Algo no está bien?
#764 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
69/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
php
Área
api, backend, security

Línea de trabajo

Read X5UFactory::loadFromUrl() and the certificate loading path through KeyConverter::loadKeyFromCertificate(). Reproduce with the provided MockHttpClient example and check existing tests for x5u certificate formats. Done means entries containing the PEM marker no longer let OpenSSL interpret the value as a file:// path while the listed certificate formats still load.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
Version(s) affected

Every release since 1.0.1 / 1.1.0, including 3.4.12, 4.0.8, 4.1.10, 4.2.5 and 4.3.x-dev

Description

X5UFactory::loadFromUrl() wraps an entry between PEM markers only when the entry does not already contain -----BEGIN CERTIFICATE-----, then hands it to openssl_x509_read() through KeyConverter::loadKeyFromCertificate(). OpenSSL opens a file when the string starts with file://. An entry such as

file:///-----BEGIN CERTIFICATE-----/../path/to/cert.pem

is therefore not wrapped, and the application reads /path/to/cert.pem. The path is resolved lexically, so the marker directory does not need to exist. If the file holds a PEM certificate, its public key and x5c come back as a key of the set; any other file gives the usual Unable to load the certificate.. open_basedir applies.

Only the host that answers the configured x5u URL (or the network, for an http:// URL) controls these entries. That host already chooses the keys, so no token can be forged this way. It can however probe the server for certificate files, and make the worker block on a path such as a FIFO.

How to reproduce
use Jose\Component\KeyManagement\X5UFactory;
use Symfony\Component\HttpClient\MockHttpClient;
use Symfony\Component\HttpClient\Response\MockResponse;

$client = new MockHttpClient(new MockResponse(json_encode([
    'partner' => ['file:///-----BEGIN CERTIFICATE-----/..' . $absolutePathOfALocalCertificate],
])));
$keySet = (new X5UFactory($client))->loadFromUrl('https://partner.example.com/x5u');

// $keySet->get('partner') is the local certificate. The same entry without the marker is refused.
Possible Solution

In X5UFactory, when the marker is present, pass OpenSSL the entry from the marker on (substr($cert, strpos($cert, $marker))), and wrap it as today otherwise. The string then never starts with file://, and the formats accepted today (base64 body, PEM block, PEM preceded by text) still load. That fits a patch release.

JWKFactory::createFromCertificate() and createFromKey() (and the 4.3 fromCertificate() / fromKey()) accept file:// strings as well, because OpenSSL does. Only application strings reach them, and some code may rely on it, so refusing file:// there should go through a deprecation that points to createFromCertificateFile() / createFromKeyFile().

Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-3MVD83LW). Same trust boundary as #762: the key set host reaching beyond the document it serves.

Lenguaje dominante
PHP
Estrellas
954
Forks
119
Merge medio
48 min
PR fusionados (30 d)
17

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de web-token/jwt-framework

Todos los issues de web-token/jwt-framework

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.