[java-oidc-common] branch main updated: Add smoke test to ensure Nimbus will not parse symmetric key in header

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=0f5341df505fba916b83a0a0c97f233ed3b47684

The following commit(s) were added to refs/heads/main by this push:
     new 0f5341d  Add smoke test to ensure Nimbus will not parse symmetric key in header
0f5341d is described below

commit 0f5341df505fba916b83a0a0c97f233ed3b47684
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Oct 28 11:54:18 2022 +0100

    Add smoke test to ensure Nimbus will not parse symmetric key in header
---
 .../impl/ExplicitKeySignedJWTTrustEngineTest.java  | 30 ++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
index 36a7550..eced91a 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/impl/ExplicitKeySignedJWTTrustEngineTest.java
@@ -24,6 +24,7 @@ import static org.testng.Assert.fail;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.security.KeyException;
+import java.text.ParseException;
 import java.util.Collections;
 import java.util.List;
 
@@ -84,7 +85,18 @@ public class ExplicitKeySignedJWTTrustEngineTest {
             + "Ku8Yx+aYhYITnq5yyPiJpyHfgDj6MVlA1vUWqB9MwlvKOywLNCFfDZj6+TCjzCJF\n"
             + "XQIDAQAB";
     
-
+    /** 
+     * This is a forged JWT that contains a 'secret' inside the JWK header. This should
+     * never happen, but we want to test that we can not create a SignedJWT from it.
+     */
+    private final String JWT_WITH_INLINE_SHARED_SECRET_JWK = 
+            "eyJraWQiOiIxMjMiLCJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiIsImp3ayI6eyJrdHkiO"
+            + "iJvY3QiLCJraWQiOiIxMjMiLCJrIjoiV0hBeWN6VjJPSGt2UWo5RktFZ3JUV0pSWlZSb"
+            + "1YyMVpjVE4wTm5jNWVpUSIsImFsZyI6IkhTMjU2In19.eyJpc3MiOiJodHRwczpcL1wv"
+            + "b3AuZXhhbXBsZS5jb21cLyIsIm5hbWUiOiJKIERvZSIsImF1ZCI6Imh0dHBzOlwvXC9y"
+            + "cC5leGFtcGxlLmNvbSIsInN1YiI6Impkb2UiLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJq"
+            + "ZG9lIn0.q0XGQTDjL2RPVY1DUswmBh7Q8D-vkJw0KruoUJbSU9c";
+    
     /** The client_secret.*/
     private static final String CLIENT_SECRET = "Xp2s5v8y/B?E(H+MbQeThWmYq3t6w9z$";
     
@@ -234,7 +246,21 @@ public class ExplicitKeySignedJWTTrustEngineTest {
                 criteria);
         assertTrue(valid);
     }
-
+    
+    /**
+     * A shared secret would never come via a JWK, but test in case of forgery.
+     * We should not support shared secrets in JWKs. Nimbus should not parse such a header.
+     * Add a smoke test to ensure this is always the case.
+     * 
+     * @throws Exception on error.
+     */
+    @Test(expectedExceptions = ParseException.class)
+    public void testInvalid_WithInlineSharedSecretJWK() throws Exception {
+        
+        final SignedJWT jws = 
+                SignedJWT.parse(JWT_WITH_INLINE_SHARED_SECRET_JWK);
+    }
+    
     @Test
     public void testInvalid_WithUntrustedInlineJWK_CVE_2018_0114() throws JOSEException, SecurityException {
         

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.