json-jwt 1.16.1 → 1.16.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0593ae4268dde10889b1e4272e01d7c95f2fdb2c69b365b81b67837b66d30531'
-  data.tar.gz: 27badbcb85bf47a663eed76b859cf0c7d502a0bb683a8f10ce9d8e3539a9149c
+  metadata.gz: 943e11e9656a90f2d3557da3a0c227453b1e110e06d01bf6e1935deebc8bd44c
+  data.tar.gz: 0645022a7f9972fbfcf82afe24f209e62c168f57d4e2d6128adcfd00309bdf80
 SHA512:
-  metadata.gz: aa6a607b44857bddb3f1f489c60cea213eaef6c4ab3481ffb3b665b21c4088bc7e12724bda2ca6c66d55cc2032cc392f85d08cabc6e774f5e8cb13bd62ec695d
-  data.tar.gz: c75bd449bb1e6d746e456ea2c58582cfff85a4d285f30d53e4b724f7904d13f626f84899034dffccdf4e9c41db0721b1573d968c45d2c123b1fb1e42e1379f8b
+  metadata.gz: d70e5a720c705ec1bb82d0c334dc15f78b2346c91932eb3ff67a454dd17b17cbcbaecebe3a3f5f4b0254dfdad9ef89df3c0e567f9efdda1c638daaf86fc25ecd
+  data.tar.gz: 29f755168b6be56c8d32d8ef4c9339129d6ad8ce5710a3b1e76e2f3da87714031660370f8728a044ca760f1a4ad23425d94c0fe2f6a671b837ea1d636fa14f82

data/.github/workflows/spec.yml

@@ -13,12 +13,11 @@ jobs:
   spec:
     strategy:
       matrix:
-        os: ['ubuntu-20.04']
-        ruby-version: ['2.6', '2.7', '3.0', '3.1']
-        # ubuntu 22.04 only supports ssl 3 and thus only ruby 3.1
+        os: ['ubuntu-20.04', 'ubuntu-22.04']
+        ruby-version: ['3.1', '3.2']
         include:
-        - os: 'ubuntu-22.04'
-          ruby-version: '3.1'
+        - os: 'ubuntu-20.04'
+          ruby-version: '3.0'
     runs-on: ${{ matrix.os }}
 
     steps:

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [1.16.0] - 2022-10-08
 
+### Fixed
+
+- Remove padding oracle by @btoews in https://github.com/nov/json-jwt/pull/109
+
+## [1.16.0] - 2022-10-08
+
 ### Added
 
 - start recording CHANGELOG

data/VERSION

@@ -1 +1 @@
-1.16.1
+1.16.2

data/lib/json/jwk/set/fetcher.rb

@@ -6,6 +6,8 @@ module JSON
           def fetch(cache_key, options = {})
             yield
           end
+
+          def delete(cache_key, options = {}); end
         end
 
         def self.logger
@@ -72,7 +74,12 @@ module JSON
           )
 
           if auto_detect
-            jwks[kid] or raise KidNotFound
+            if jwks[kid]
+              jwks[kid]
+            else
+              cache.delete(cache_key)
+              raise KidNotFound
+            end
           else
             jwks
           end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: json-jwt
 version: !ruby/object:Gem::Version
-  version: 1.16.1
+  version: 1.16.2
 platform: ruby
 authors:
 - nov matake
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-10-20 00:00:00.000000000 Z
+date: 2023-01-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -197,7 +197,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.3.26
 signing_key:
 specification_version: 4
 summary: JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and