jose-jwt 0.7.3 → 0.7.4
raw patch · 5 files changed
+22/−11 lines, 5 filesPVP ok
version bump matches the API change (PVP)
API changes (from Hackage documentation)
Files
- CHANGELOG.md +5/−0
- Jose/Jwk.hs +7/−6
- jose-jwt.cabal +1/−1
- tests/Tests/JweSpec.hs +6/−1
- tests/Tests/JwsSpec.hs +3/−3
CHANGELOG.md view
@@ -1,3 +1,8 @@+0.7.4+-----++* Stricter checking of AES key lengths when looking for a valid JWK to encode/decode an AES-KW JWT.+ 0.7.3 -----
Jose/Jwk.hs view
@@ -28,6 +28,7 @@ import Data.Aeson (genericToJSON, Value(..), FromJSON(..), ToJSON(..), withText) import Data.Aeson.Types (Parser, Options (..), defaultOptions) import Data.ByteString (ByteString)+import qualified Data.ByteString as B import Data.Maybe (isNothing) import Data.Text (Text) import qualified Data.Text.Encoding as TE@@ -126,9 +127,9 @@ case (jweAlg hdr, jwk) of (RSA1_5, RsaPrivateJwk {}) -> True (RSA_OAEP, RsaPrivateJwk {}) -> True- (A128KW, SymmetricJwk {}) -> True- (A192KW, SymmetricJwk {}) -> True- (A256KW, SymmetricJwk {}) -> True+ (A128KW, SymmetricJwk k _ _ _) -> B.length k == 16+ (A192KW, SymmetricJwk k _ _ _) -> B.length k == 24+ (A256KW, SymmetricJwk k _ _ _) -> B.length k == 32 _ -> False canEncodeJwe :: JweAlg -> Jwk -> Bool@@ -139,9 +140,9 @@ (RSA_OAEP, RsaPublicJwk {}) -> True (RSA1_5, RsaPrivateJwk {}) -> True (RSA_OAEP, RsaPrivateJwk {}) -> True- (A128KW, SymmetricJwk {}) -> True- (A192KW, SymmetricJwk {}) -> True- (A256KW, SymmetricJwk {}) -> True+ (A128KW, SymmetricJwk k _ _ _) -> B.length k == 16+ (A192KW, SymmetricJwk k _ _ _) -> B.length k == 24+ (A256KW, SymmetricJwk k _ _ _) -> B.length k == 32 _ -> False keyIdCompatible :: Maybe KeyId -> Jwk -> Bool
jose-jwt.cabal view
@@ -1,5 +1,5 @@ Name: jose-jwt-Version: 0.7.3+Version: 0.7.4 Synopsis: JSON Object Signing and Encryption Library Homepage: http://github.com/tekul/jose-jwt Bug-Reports: http://github.com/tekul/jose-jwt/issues
tests/Tests/JweSpec.hs view
@@ -147,7 +147,7 @@ jweRoundTrip :: RNG -> JWEAlgs -> [Word8] -> Bool jweRoundTrip g (JWEAlgs a e) msg = encodeDecode == Right (Jwe (defJweHdr {jweAlg = a, jweEnc = e}, bs)) where- jwks = [a1jwk, a2jwk, a3jwk] >>= \j -> let Just jwk = decodeStrict' j in [jwk]+ jwks = [a1jwk, a2jwk, a3jwk, aes192jwk, aes256jwk] >>= \j -> let Just jwk = decodeStrict' j in [jwk] bs = B.pack msg encodeDecode = fst (withDRG blinderRNG (decode jwks Nothing encoded)) Right encoded = unJwt <$> fst (withDRG g (encode jwks (JweEncoding a e) (Claims bs)))@@ -241,6 +241,11 @@ a3Payload = a2Payload a3jwk = "{\"kty\":\"oct\", \"k\":\"GawgguFyGrWKav7AX4VKUg\"}"++-- We need keys that are valid for AES192 and AES256 for quickcheck tests+aes192jwk = "{\"kty\":\"oct\", \"k\":\"FatNm7ez26tyPGsXdaqhYHtvThX0jSAA\"}"+aes256jwk = "{\"kty\":\"oct\", \"k\":\"1MeiHdxK8CQBsmjgOM8SCxg06MTjFzG7sFa7EnDCJzo\"}"+ a3cek = B.pack [4, 211, 31, 197, 84, 157, 252, 254, 11, 100, 157, 250, 63, 170, 106, 206, 107, 124, 212, 45, 111, 107, 9, 219, 200, 177, 0, 240, 143, 156, 44, 207]
tests/Tests/JwsSpec.hs view
@@ -77,11 +77,11 @@ fstWithRNG (decode [k31] Nothing a31) @?= fmap Jws a31decoded context "when using an unsecured JWT" $ do- it "returns an error if alg is unset" $+ it "returns an error if chosen alg is unset" $ fstWithRNG (decode [] Nothing jwt61) @?= Left (BadAlgorithm "JWT is unsecured but expected 'alg' was not 'none'")- it "returns an error if alg is is not 'none'" $+ it "returns an error if chosen alg is not 'none'" $ fstWithRNG (decode [] (Just (JwsEncoding RS256)) jwt61) @?= Left (BadAlgorithm "JWT is unsecured but expected 'alg' was not 'none'")- it "decodes the JWT to the expected header and payload" $+ it "decodes the JWT to the expected header and payload if chosen alg is 'none'" $ fstWithRNG (decode [] (Just (JwsEncoding None)) jwt61) @?= Right (Unsecured jwt61Payload)