X5UFactory: an x5u entry can name a local file

オープン
  • 何か問題がありますか？
#764 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
69/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
php
領域
api, backend, security

調査の方向性

Read X5UFactory::loadFromUrl() and the certificate loading path through KeyConverter::loadKeyFromCertificate(). Reproduce with the provided MockHttpClient example and check existing tests for x5u certificate formats. Done means entries containing the PEM marker no longer let OpenSSL interpret the value as a file:// path while the listed certificate formats still load.

索引モデルが issue の本文から書いたものです。

説明

bug
Version(s) affected

Every release since 1.0.1 / 1.1.0, including 3.4.12, 4.0.8, 4.1.10, 4.2.5 and 4.3.x-dev

Description

X5UFactory::loadFromUrl() wraps an entry between PEM markers only when the entry does not already contain -----BEGIN CERTIFICATE-----, then hands it to openssl_x509_read() through KeyConverter::loadKeyFromCertificate(). OpenSSL opens a file when the string starts with file://. An entry such as

file:///-----BEGIN CERTIFICATE-----/../path/to/cert.pem

is therefore not wrapped, and the application reads /path/to/cert.pem. The path is resolved lexically, so the marker directory does not need to exist. If the file holds a PEM certificate, its public key and x5c come back as a key of the set; any other file gives the usual Unable to load the certificate.. open_basedir applies.

Only the host that answers the configured x5u URL (or the network, for an http:// URL) controls these entries. That host already chooses the keys, so no token can be forged this way. It can however probe the server for certificate files, and make the worker block on a path such as a FIFO.

How to reproduce
use Jose\Component\KeyManagement\X5UFactory;
use Symfony\Component\HttpClient\MockHttpClient;
use Symfony\Component\HttpClient\Response\MockResponse;

$client = new MockHttpClient(new MockResponse(json_encode([
    'partner' => ['file:///-----BEGIN CERTIFICATE-----/..' . $absolutePathOfALocalCertificate],
])));
$keySet = (new X5UFactory($client))->loadFromUrl('https://partner.example.com/x5u');

// $keySet->get('partner') is the local certificate. The same entry without the marker is refused.
Possible Solution

In X5UFactory, when the marker is present, pass OpenSSL the entry from the marker on (substr($cert, strpos($cert, $marker))), and wrap it as today otherwise. The string then never starts with file://, and the formats accepted today (base64 body, PEM block, PEM preceded by text) still load. That fits a patch release.

JWKFactory::createFromCertificate() and createFromKey() (and the 4.3 fromCertificate() / fromKey()) accept file:// strings as well, because OpenSSL does. Only application strings reach them, and some code may rely on it, so refusing file:// there should go through a deprecation that points to createFromCertificateFile() / createFromKeyFile().

Additional Context

Found by the Anthropic OSS Scanner (ANT-2026-3MVD83LW). Same trust boundary as #762: the key set host reaching beyond the document it serves.

主要言語
PHP
スター
954
フォーク
119
平均マージ
48分
マージ済み PR（30日）
17

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

web-token/jwt-framework のほかの issue

web-token/jwt-framework の issue をすべて見る

似ている issue

PHP の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。