[java-oidfed-common] branch main updated: Deserialize only public keys from the entity statement payload

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-oidfed-common.

View the commit online:
https://codeberg.org/Shibboleth/java-oidfed-common/commit/8d4153cc23a043547db9b4df7a659475516d4978

The following commit(s) were added to refs/heads/main by this push:
     new 8d4153c  Deserialize only public keys from the entity statement payload
8d4153c is described below

commit 8d4153cc23a043547db9b4df7a659475516d4978
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Wed Oct 7 18:17:06 2026 +0300

    Deserialize only public keys from the entity statement payload
    
    - IOException if the keys are private
---
 .../shibboleth/oidfed/metadata/jackson/JWKDeserializer.java   | 11 +++--------
 .../oidfed/metadata/jackson/JWKSetDeserializer.java           | 11 +++--------
 2 files changed, 6 insertions(+), 16 deletions(-)

diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/jackson/JWKDeserializer.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/jackson/JWKDeserializer.java
index 4f10037..5e92d7f 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/jackson/JWKDeserializer.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/jackson/JWKDeserializer.java
@@ -20,8 +20,6 @@ import java.util.Map;
 
 import javax.annotation.Nonnull;
 
-import org.slf4j.Logger;
-
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.DeserializationContext;
@@ -31,16 +29,11 @@ import com.fasterxml.jackson.databind.type.MapType;
 import com.fasterxml.jackson.databind.type.TypeFactory;
 import com.nimbusds.jose.jwk.JWK;
 
-import net.shibboleth.shared.primitive.LoggerFactory;
-
 /**
  * Jackson deserializer for {@link JWK} that exploits {@link JWK#parse(Map)}.
  */
 public class JWKDeserializer extends JsonDeserializer<JWK> {
 
-    /** Class logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(JWKDeserializer.class);
-
     /**
      * Constructor.
      */
@@ -53,7 +46,6 @@ public class JWKDeserializer extends JsonDeserializer<JWK> {
     public JWK deserialize(final JsonParser jsonParser, final DeserializationContext deserializationContext)
             throws IOException, JsonProcessingException {
 
-        log.debug("Starting deseralize");
         final JavaType objectType = TypeFactory.defaultInstance().constructType(Object.class);
         final JavaType stringType = TypeFactory.defaultInstance().constructType(String.class);
         final MapType objectMapType =
@@ -63,6 +55,9 @@ public class JWKDeserializer extends JsonDeserializer<JWK> {
         try {
             final JWK result = JWK.parse(map);
             assert result != null;
+            if (result.isPrivate()) {
+                throw new IOException("The parsed JWK is private");
+            }
             return result;
         } catch (final ParseException e) {
             throw new IOException("Could not parse JWK from the given input", e);
diff --git a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/jackson/JWKSetDeserializer.java b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/jackson/JWKSetDeserializer.java
index a3e6248..4d5ab39 100644
--- a/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/jackson/JWKSetDeserializer.java
+++ b/oidfed-common-impl/src/main/java/net/shibboleth/oidfed/metadata/jackson/JWKSetDeserializer.java
@@ -20,8 +20,6 @@ import java.util.Map;
 
 import javax.annotation.Nonnull;
 
-import org.slf4j.Logger;
-
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.DeserializationContext;
@@ -31,16 +29,11 @@ import com.fasterxml.jackson.databind.type.MapType;
 import com.fasterxml.jackson.databind.type.TypeFactory;
 import com.nimbusds.jose.jwk.JWKSet;
 
-import net.shibboleth.shared.primitive.LoggerFactory;
-
 /**
  * Jackson deserializer for {@link JWKSet} that exploits {@link JWKSet#parse(Map)}.
  */
 public class JWKSetDeserializer extends JsonDeserializer<JWKSet> {
 
-    /** Class logger. */
-    @Nonnull private final Logger log = LoggerFactory.getLogger(JWKSetDeserializer.class);
-
     /**
      * Constructor.
      */
@@ -53,7 +46,6 @@ public class JWKSetDeserializer extends JsonDeserializer<JWKSet> {
     public JWKSet deserialize(final JsonParser jsonParser, final DeserializationContext deserializationContext)
             throws IOException, JsonProcessingException {
 
-        log.debug("Starting deseralize");
         final JavaType objectType = TypeFactory.defaultInstance().constructType(Object.class);
         final JavaType stringType = TypeFactory.defaultInstance().constructType(String.class);
         final MapType objectMapType =
@@ -63,6 +55,9 @@ public class JWKSetDeserializer extends JsonDeserializer<JWKSet> {
         try {
             final JWKSet result = JWKSet.parse(map);
             assert result != null;
+            if (result.containsNonPublicKeys()) {
+                throw new IOException("The parsed JWKSet contains non-public keys");
+            }
             return result;
         } catch (final ParseException e) {
             throw new IOException("Could not parse JWKSet from the given input", e);

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.