Claim and header checker managers silently keep only the last checker of a claim or header parameter

Aperta
  • Qualcosa non va?
#756 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
42/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
php
Ambito
backend, security

Direzione di ricerca

Read the ClaimCheckerManager and HeaderCheckerManager constructors, then trace the library and bundle factory paths and the checker configuration aliases described in the issue. Compare the behavior across the 4.3.x and 5.0.x branches; done means duplicate checker names are reported or rejected as specified for each branch, and the documented one-checker-per-name rule covers bundle configuration.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
Version(s) affected

All released versions since 0.2.0 (3.4.x, 4.0.x, 4.1.x, 4.2.x), and the 4.3.x and 5.0.x branches.

Description

ClaimCheckerManager and HeaderCheckerManager index their checkers by supportedClaim() / supportedHeader(). When two checkers of the list cover the same name, the second one replaces the first, which never runs. Nothing is thrown or logged.

$manager = new ClaimCheckerManager([
    new ExpirationTimeChecker($clock),
    new CallableChecker('exp', $maxLifetime), // at most one hour left to live
]);
$manager->getCheckers(); // ['exp' => CallableChecker]

With this list an expired token passes check(). With the two checkers in the other order, a token valid for ten years passes. No order enforces both rules. Two AudienceCheckers behave the same way. In a header checker manager, the replacement can also drop the protected-only requirement of that parameter.

Every construction path ends in these constructors: the library and bundle factories, jose.checkers.claims / jose.checkers.headers, and the header_checkers of the loaders. In the bundle the lists hold aliases, which do not show the name each checker covers: claims: ['exp', 'iat', 'nbf', 'max_lifetime'], where max_lifetime is a CallableChecker('exp', ...) service, gives a manager without ExpirationTimeChecker. On 4.3.x, the typ: option appends a generated TypeChecker, which replaces any typ checker listed in headers: of the same manager.

Before 0.2.0 the managers refused a second checker for a name (The claim checker "%s" is already supported.). That guard was removed in 387aac8b (November 2017), together with the alias guard of the factories.

Only applications that give one manager two checkers for the same claim or header parameter are concerned. For them, the rule of the replaced checker is not enforced, and nothing tells them.

How to reproduce
$manager = new ClaimCheckerManager([
    new AudienceChecker('api'),
    new AudienceChecker('tenant-42'),
]);
$manager->check(['aud' => ['other', 'tenant-42']]); // passes: the "api" checker never runs
Possible Solution
  • 4.3.0: trigger a deprecation in both constructors when a name is already covered by a different checker instance (the same instance listed twice stays silent), and keep the current behaviour.
  • 5.0.0: throw an InvalidArgumentException.
  • Document that a manager takes one checker per claim or header parameter, and that several rules on one claim belong in one checker.
Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-YWJFJRRB).

Lingua principale
PHP
Stelle
954
Fork
119
Merge medio
48m
PR unite (30g)
17

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di web-token/jwt-framework

Tutte le issue di web-token/jwt-framework

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.