[java-oidc-common] branch main updated: Validate content encryption algorithm against exclusion in all cases.

[Henri Mikkonen]

This is an automated email from the git hooks/post-receive script.

hjmikkon pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=e955dba34db2e719b205aa9943e117d26294ea4d

The following commit(s) were added to refs/heads/main by this push:
     new e955dba  Validate content encryption algorithm against exclusion in all cases.
e955dba is described below

commit e955dba34db2e719b205aa9943e117d26294ea4d
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Mar 24 14:19:31 2023 +0200

    Validate content encryption algorithm against exclusion in all cases.
---
 .../oidc/security/impl/JWETokenDecrypter.java      | 38 ++++++++++++++++------
 1 file changed, 28 insertions(+), 10 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
index 4f406b6..34beadf 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/JWETokenDecrypter.java
@@ -355,6 +355,7 @@ public class JWETokenDecrypter {
                 }
                 try {
                     validateKeyManagmentAlgorithm(encryptedObject, (JWKCredential)cred);
+                    validateContentEncryptionAlgorithm(encryptedObject);
                     final JWEDecrypter decrypter = new ECDHDecrypter((ECPrivateKey)cred.getPrivateKey());
                     encryptedObject.decrypt(decrypter);
                     return;
@@ -462,6 +463,7 @@ public class JWETokenDecrypter {
                 }
                 try {
                     validateKeyManagmentAlgorithm(encryptedObject, (JWKCredential)cred);
+                    validateContentEncryptionAlgorithm(encryptedObject);
                     final JWEDecrypter decrypter = new RSADecrypter(cred.getPrivateKey());
                     encryptedObject.decrypt(decrypter);
                     return;
@@ -584,22 +586,20 @@ public class JWETokenDecrypter {
         return headerAlg;
     }
  // Checkstyle: CyclomaticComplexity OFF
-    
+
     /**
-     * Validates the 'enc' algorithm in the header matches the encryption algorithm specified for the credential, 
-     * and validates against the include and exclude algorithm URI lists. If valid, the encryption algorithm from
-     * the header is returned. If not valid, an {@link DecryptionException} is thrown.
+     * Validates the 'enc' algorithm in the header against the include and exclude algorithm URI lists. If valid, the
+     * encryption algorithm from the header is returned. If not valid, an {@link DecryptionException} is thrown.
      * 
      * @param encryptedObject the JWE
-     * @param cred the credential to validate the 'enc' header
      * 
      * @return the content encryption algorithm from the JOSE header.
      * 
      * @throws DecryptionException if there is an algorithm mismatch.
      */
     @Nonnull private EncryptionMethod validateContentEncryptionAlgorithm(
-            @Nonnull final EncryptedJWT encryptedObject, @Nonnull final JWKCredential cred) throws DecryptionException {
-        
+            @Nonnull final EncryptedJWT encryptedObject) throws DecryptionException {
+
         if (encryptedObject.getHeader() == null) {
             throw new DecryptionException("JWE did not contain a JOSE header, is in an illegal state");
         }
@@ -609,10 +609,28 @@ public class JWETokenDecrypter {
             throw new DecryptionException("JWE did not contain an 'enc' JOSE header, is in an illegal state");
         }
             
-        final String encAlgorithmURI = StringSupport.trimOrNull(enc.getName());        
-        validateAlgorithmURI(encAlgorithmURI);
+        validateAlgorithmURI(StringSupport.trimOrNull(enc.getName()));
+        return enc;
+    }
+
+    /**
+     * Validates the 'enc' algorithm in the header matches the encryption algorithm specified for the credential, 
+     * and validates against the include and exclude algorithm URI lists. If valid, the encryption algorithm from
+     * the header is returned. If not valid, an {@link DecryptionException} is thrown.
+     * 
+     * @param encryptedObject the JWE
+     * @param cred the credential to validate the 'enc' header
+     * 
+     * @return the content encryption algorithm from the JOSE header.
+     * 
+     * @throws DecryptionException if there is an algorithm mismatch.
+     */
+    @Nonnull private EncryptionMethod validateContentEncryptionAlgorithm(
+            @Nonnull final EncryptedJWT encryptedObject, @Nonnull final JWKCredential cred) throws DecryptionException {
+        
+        final EncryptionMethod enc = validateContentEncryptionAlgorithm(encryptedObject);
         
-        final String jcaKeyAlgorithm = AlgorithmSupport.getKeyAlgorithm(encAlgorithmURI);
+        final String jcaKeyAlgorithm = AlgorithmSupport.getKeyAlgorithm(StringSupport.trimOrNull(enc.getName()));
         
         if (cred.getSecretKey() == null) {
             throw new DecryptionException("Credential does not contain a content encryption secret key");

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.