JWELoaderFactory and JWSLoaderFactory ignore the requested header checkers when they have no HeaderCheckerManagerFactory

Abierto
  • ¿Algo no está bien?
#768 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
56/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
php, symfony
Área
authentication, backend

Línea de trabajo

Start with JWELoaderFactory and JWSLoaderFactory, then inspect the corresponding bundle factories and the service names described in the bundle documentation. Check how create() handles requested header checker aliases when no manager factory is available, including the empty list case. Done means the documented services are accurate and requested aliases cannot be silently ignored.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug
Version(s) affected

All released versions since 1.1.0 (3.4.x, 4.0.x, 4.1.x, 4.2.x), and the 4.3.x and 5.0.x branches.

Description

The third constructor argument of Jose\Component\Encryption\JWELoaderFactory and Jose\Component\Signature\JWSLoaderFactory is a nullable HeaderCheckerManagerFactory. When it is null, create() ignores $headerCheckers and returns a loader without header checker manager, which checks no header parameter at all (typ, alg, crit, exp…). Nothing is thrown, even for an alias that does not exist, whereas an unknown serializer or algorithm alias is refused. NestedTokenLoaderFactory passes its two lists to these factories and behaves the same.

$factory = new JWELoaderFactory($serializerManagerFactory, $decrypterFactory, null);
$loader = $factory->create(['jwe_compact'], ['A256KW', 'A256GCM'], ['access_token_type']);
$loader->getHeaderCheckerManager(); // null

With the Symfony bundle this happens without anybody writing null. The bundle documentation fetches Jose\Component\Encryption\JWELoaderFactory (likewise JWSLoaderFactory, JWEDecrypterFactory, JWSVerifierFactory, the builder and checker manager factories) from the container, but since 2.0 the bundle registers Jose\Bundle\JoseFramework\Services\* instead. An application that then registers the library classes itself, with autowiring, gets null as third argument: no service has the type Jose\Component\Checker\HeaderCheckerManagerFactory, and the argument is nullable.

Loaders declared in the bundle configuration (jose.jwe.loaders, jose.jws.loaders) and loaders created by the bundle's own factories are not affected.

How to reproduce

With autowire: true, register Jose\Component\Encryption\JWEDecrypterFactory and Jose\Component\Encryption\JWELoaderFactory as services, and a TypeChecker('at+jwt') tagged jose.checker.header with the alias access_token_type. A loader created by the library factory with create(['jwe_compact'], ['A256KW', 'A256GCM'], ['access_token_type']) accepts a JWE whose protected header has "typ":"refresh+jwt". The loader created by the bundle's factory with the same arguments rejects it with Unsupported type..

Possible Solution
  • Throw an InvalidArgumentException from create() when header checker aliases are requested and no HeaderCheckerManagerFactory is available, and keep returning a loader without manager for an empty list. Same change in the two factories of the bundle.
  • Fix the bundle documentation so that it names the services the bundle registers.
  • 5.0.0: consider making the argument non-nullable, which turns the autowiring case into a container error.
  • Changelog: such a configuration now fails when the loader is created.
Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-F6XYPNCA).

Lenguaje dominante
PHP
Estrellas
954
Forks
119
Merge medio
48 min
PR fusionados (30 d)
17

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de web-token/jwt-framework

Todos los issues de web-token/jwt-framework

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.