[java-oidc-common] branch main updated: Improve JavaDoc

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=8d6bab3f4d14bfce7a01b882d98317b2d0470038

The following commit(s) were added to refs/heads/main by this push:
     new 8d6bab3  Improve JavaDoc
8d6bab3 is described below

commit 8d6bab3f4d14bfce7a01b882d98317b2d0470038
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Oct 7 11:30:37 2022 +0100

    Improve JavaDoc
---
 .../security/impl/ExplicitKeySignedJWTTrustEngineTest.java  | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
index 18847d3..41fb427 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
@@ -137,12 +137,13 @@ public class ExplicitKeySignedJWTTrustEngineTest {
     
     /**
      * Test for CVE-2016-10555. That is, can a malicious user choose which algorithm to verify the
-     * token with. If so, they could sign the JWT with the servers public key, change the 
-     * algorithm to HS256 (or a MAC version) and have the server (if vulnerable) validate
-     * it against the public key it has locally.
+     * token with. If so, they could create a MAC for the JWT with the servers public key as a 
+     * secret, change the algorithm to HS256 (a MAC version) and have the server (if vulnerable) validate
+     * it against the public key it has locally - so the server assumes it always needs to use
+     * the public key to verify signatures, and passes it in as a secret to the MAC verifier.
      * 
      * <p>This is only likely in cases where the implementation only expects to verify using
-     * a public key, and has a generic method that accepts the public key, but can actually
+     * a public key and has a generic method that accepts the public key, but can actually
      * use a MAC verification method - with the public key. So a fairly unusual case!.</p>
      * 
      * @throws Exception on error.
@@ -178,9 +179,9 @@ public class ExplicitKeySignedJWTTrustEngineTest {
         final CriteriaSet criteria = new CriteriaSet();
         criteria.add(new UsageCriterion(UsageType.SIGNING));
         
-        // This is a crafted JWS (from jwt_tool) using the public RSA key to sign as a MAC
+        // This is a crafted JWS (from jwt_tool) using the public RSA key bits to sign a MAC.
         // The server *might* if vulnerable valid it it using the RSA public
-        // key it has using the MAC validator.
+        // key it has using the a MAC validator.
         final SignedJWT jws = 
                 SignedJWT.parse("eyJraWQiOiJtb2NrLWtleSIsInR5cCI6IkpXVCIsImFsZyI6IkhTMjU2In0."
                         + "eyJpc3MiOiJodHRwczovL29wLmV4YW1wbGUuY29tLyIsIm5hbWUiOiJKIERvZSIsIm"

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.