JWT::EncodedToken raises TypeError for a non-object header
Maintainers usually reply within 1 day
A pull request for this has already been merged.
- #783 by @anakinj — merged
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- ruby
- Domain
- authentication, security
Research direction
Start in lib/jwt/encoded_token.rb, where valid_signature? reads header['alg'] without checking the decoded header is a Hash. Compare with the check in JWT::Decode#verify_algo, and reproduce with the snippet in the issue to see the raw TypeError. Done when a non-object header raises JWT::MalformedTokenError from verify_signature!, with a regression test added beside the existing encoded-token tests.
Written by the indexing model from the issue text.
Description
If a token's header is valid JSON but not an object, JWT::EncodedToken#verify_signature! raises a raw TypeError instead of a JWT error. Applications that rescue JWT errors won't catch it, so untrusted input could produce a 500 rather than a 401. JWT.decode handles the same token correctly.
rsa = OpenSSL::PKey::RSA.generate(2048)
b64 = ->(value) { JWT::Base64.url_encode(value) }
token = "#{b64.call('[]')}.#{b64.call('{}')}.#{b64.call('x')}"
JWT::EncodedToken.new(token).verify_signature!(algorithm: 'RS256', key: rsa.public_key)
# => TypeError: no implicit conversion of String into Integer
JWT.decode(token, rsa.public_key, true, algorithm: 'RS256')
# => JWT::MalformedTokenError: Token header not a JSON object
Reproduced on 3.3.1. lib/jwt/encoded_token.rb is unchanged on main.
Cause: EncodedToken#valid_signature? reads header['alg'] without checking that the header is a Hash. JWT::Decode#verify_algo has that check.
Suggestion: Raise JWT::MalformedTokenError when the decoded header isn't an object, covering valid_signature? and any other direct header[...] access on this path.
Posted by Claude on behalf of @anakinj.
- Dominant language
- Ruby
- Stars
- 3.7k
- Forks
- 381
- Avg merge
- 17h 10m
- Merged PRs (30d)
- 11
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from jwt/ruby-jwt
-
Difficulty 4/5 3-5 days Newbie friendliness 15/100
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
jwt/ruby-jwt#743 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
jwt/ruby-jwt#723 · 2 comments ·
Maintainers usually reply within 1 day
-
feature
Difficulty 5/5 Over a week Newbie friendliness 35/100
jwt/ruby-jwt#428 · 7 comments · 1 reaction ·
Maintainers usually reply within 1 day
-
enhancement feature help wanted up for grabs
Difficulty 5/5 Over a week Newbie friendliness 25/100
jwt/ruby-jwt#80 · 11 comments · 8 reactions ·
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
swombat/souls-house#770 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
riverqueue/river#1576 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
presidentbeef/brakeman#2063 ·