Malformed identity JWT encoding raises instead of expiring the cached token
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Start with ComputeMetadata#determine_identity_lifetime and reproduce the invalid URL-safe Base64 case described in the issue. Check the existing malformed-JSON handling and verify that malformed JWT payloads produce a zero lifetime without changing the valid-token lifetime path. Confirm the relevant test suite still passes.
Written by the indexing model from the issue text.
Description
Summary
ComputeMetadata#determine_identity_lifetime rescues malformed JSON, but not malformed URL-safe Base64 in the JWT payload. A metadata response containing an invalid encoded payload therefore raises ArgumentError while deciding its cache lifetime instead of treating the token as immediately expired.
Reproduction
On current main (7936c72eb2c809214858f47473aafb04c6bbf469), calling the private lifetime calculation with an identity path and a token whose middle segment is invalid URL-safe Base64 raises ArgumentError from Base64.urlsafe_decode64.
Proposed correction
Handle ArgumentError alongside the existing malformed-JSON behavior and return a zero lifetime. I verified the two-line rescue against malformed padding/characters, the full current suite (91 runs / 419 assertions / 0 failures / 0 errors / 2 skips), and the normal valid-token lifetime path.
I used an AI coding assistant during investigation and verification. I am opening this issue first because this repository requires tests and a Google CLA for pull requests; I have not modified repository tests or signed a CLA as part of this audit.
- Dominant language
- Ruby
- Stars
- 16
- Forks
- 12
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from googleapis/ruby-cloud-env
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
googleapis/ruby-cloud-env#112 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
googleapis/ruby-cloud-env#110 · 1 comment ·
-
priority: p3 type: feature request
Difficulty 5/5 Over a week Newbie friendliness 35/100
googleapis/ruby-cloud-env#90 ·
-
Dependency Dashboard Opentype: process
Difficulty 4/5 3-5 days Newbie friendliness 20/100
googleapis/ruby-cloud-env#22 ·
All issues in googleapis/ruby-cloud-env
Similar issues
-
user-reported
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
Kong/developer.konghq.com#7316 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
TheOdinProject/curriculum#31408 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
notch8/utk_knapsack#148 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Homebrew/homebrew-cask#288729 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100