json-jwt 1.16.3 → 1.17.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e15d6297f3fe38127afb9686fcf44f6718b203b15988019897901dc62ebed1ca
-  data.tar.gz: 4fa5a17b443fb0811dc1634db20b39471aca3a7475aa4181cfe2c5c2790d7f47
+  metadata.gz: 477700420d1f91dfa45a302ecccc12c76548a8a5f281ac709f2b406b76e2abbf
+  data.tar.gz: b4e2f42d9fa50ff0902e8e72a3584ebc760d18b82c857e532f390253472d96a7
 SHA512:
-  metadata.gz: 7869a764a0700e9d016e9b3ad30952e5e34a4a2bd1b5b58b3b48887b2d7edc2836f3ec0c7ce72f3246ebda7f00cb18409e33a79953777583f347837a5445d994
-  data.tar.gz: 033e08b8548ad17468e07ea1f21bb115552a3d54163796a252d26b3e728382dc8d7a8f906555967eedb939b683880dec4603decadae7a80800cf0cc8dc082fbf
+  metadata.gz: 66ce8c45f9d3c046a749e2cff596258eec0d63ee842e8033a691efe745d8cd44b4943a8a70700cd1ee8692e4417ad67b658155a1cc7ad0cd0313d142b4751489
+  data.tar.gz: 21e4328f6b842ab18293bd735f973131db0a7ed1f308023ef976df3c25c9a4a0d59e6481f561bfa90b7921560eff7b856cc6b6cffc0e89f68ceb26b012847a39

data/.github/workflows/spec.yml

@@ -3,7 +3,7 @@ name: Spec
 on:
   push:
     branches:
-      - master
+      - main
   pull_request:
 
 permissions:
@@ -11,21 +11,21 @@ permissions:
 
 jobs:
   spec:
+    runs-on: ubuntu-latest
+    name: Ruby ${{ matrix.ruby }}
     strategy:
       matrix:
-        os: ['ubuntu-20.04', 'ubuntu-22.04']
-        ruby-version: ['3.1', '3.2']
-        include:
-        - os: 'ubuntu-20.04'
-          ruby-version: '3.0'
-    runs-on: ${{ matrix.os }}
-
+        ruby:
+          - '3.2'
+          - '3.3'
+          - '3.4'
+          - '4.0'
     steps:
     - uses: actions/checkout@v3
     - name: Set up Ruby
       uses: ruby/setup-ruby@v1
       with:
-        ruby-version: ${{ matrix.ruby-version }}
+        ruby-version: ${{ matrix.ruby }}
         bundler-cache: true
     - name: Run Specs
       run: bundle exec rake spec

data/VERSION

@@ -1 +1 @@
-1.16.3
+1.17.1

data/json-jwt.gemspec

@@ -14,6 +14,7 @@ Gem::Specification.new do |gem|
   gem.require_paths = ['lib']
   gem.required_ruby_version = '>= 2.4'
   gem.add_runtime_dependency 'activesupport', '>= 4.2'
+  gem.add_runtime_dependency 'base64'
   gem.add_runtime_dependency 'bindata'
   gem.add_runtime_dependency 'aes_key_wrap'
   gem.add_runtime_dependency 'faraday', '~> 2.0'

data/lib/json/jwk/set/fetcher.rb

@@ -2,6 +2,8 @@ module JSON
   class JWK
     class Set
       module Fetcher
+        class UnexpectedFormat < JWT::Exception; end
+
         class Cache
           def fetch(cache_key, options = {})
             yield
@@ -65,13 +67,18 @@ module JSON
             kid
           ].collect(&:to_s).join(':')
 
-          jwks = Set.new(
-            JSON.parse(
-              cache.fetch(cache_key, options) do
-                http_client.get(jwks_uri).body
-              end
-            )
+          parsed_jwks = JSON.parse(
+            cache.fetch(cache_key, options) do
+              http_client.get(jwks_uri).body
+            end
           )
+
+          unless parsed_jwks.is_a?(Hash) && parsed_jwks['keys'].is_a?(Array)
+            cache.delete(cache_key, options)
+            raise UnexpectedFormat
+          end
+
+          jwks = Set.new(parsed_jwks)
           cache.delete(cache_key, options) if jwks[kid].blank?
 
           if auto_detect
@@ -83,4 +90,4 @@ module JSON
       end
     end
   end
-end
+end

data/lib/json/jwk/set.rb

@@ -31,4 +31,4 @@ module JSON
       end
     end
   end
-end
+end

data/lib/json/jws.rb

@@ -20,6 +20,7 @@ module JSON
 
     def verify!(public_key_or_secret, algorithms = nil)
       if alg&.to_sym == :none
+        raise UnexpectedAlgorithm unless algorithms.blank? || Array(algorithms).include?(:none)
         raise UnexpectedAlgorithm if public_key_or_secret
         signature == '' or raise VerificationFailed
       elsif algorithms.blank? || Array(algorithms).include?(alg&.to_sym)
@@ -124,7 +125,8 @@ module JSON
       public_key_or_secret = with_jwk_support public_key_or_secret
       case
       when hmac?
-        secure_compare sign(signature_base_string, public_key_or_secret), signature
+        secret = public_key_or_secret
+        secure_compare sign(signature_base_string, secret), signature
       when rsa?
         public_key = public_key_or_secret
         public_key.verify digest, signature, signature_base_string

data/lib/json/jwt.rb

@@ -26,12 +26,12 @@ module JSON
       @content_type = 'application/jwt'
       self.typ = :JWT
       self.alg = :none
+      update claims
       unless claims.nil?
         [:exp, :nbf, :iat].each do |key|
-          claims[key] = claims[key].to_i if claims[key]
+          self[key] = self[key].to_i if self[key]
         end
       end
-      update claims
     end
 
     def sign(private_key_or_secret, algorithm = :autodetect)
@@ -109,7 +109,11 @@ module JSON
         when JWS::NUM_OF_SEGMENTS
           JWS.decode_compact_serialized jwt_string, key_or_secret, algorithms, allow_blank_payload
         when JWE::NUM_OF_SEGMENTS
-          JWE.decode_compact_serialized jwt_string, key_or_secret, algorithms, encryption_methods
+          if allow_blank_payload
+            raise InvalidFormat.new("JWE w/ blank payload is not supported.")
+          else
+            JWE.decode_compact_serialized jwt_string, key_or_secret, algorithms, encryption_methods
+          end
         else
           raise InvalidFormat.new("Invalid JWT Format. JWT should include #{JWS::NUM_OF_SEGMENTS} or #{JWE::NUM_OF_SEGMENTS} segments.")
         end
@@ -138,4 +142,4 @@ require 'json/jwe'
 require 'json/jwk'
 require 'json/jwk/jwkizable'
 require 'json/jwk/set'
-require 'json/jwk/set/fetcher'
+require 'json/jwk/set/fetcher'

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: json-jwt
 version: !ruby/object:Gem::Version
-  version: 1.16.3
+  version: 1.17.1
 platform: ruby
 authors:
 - nov matake
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-24 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -24,6 +23,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '4.2'
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: bindata
   requirement: !ruby/object:Gem::Requirement
@@ -182,7 +195,6 @@ homepage: https://github.com/nov/json-jwt
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -197,8 +209,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.26
-signing_key:
+rubygems_version: 4.0.10
 specification_version: 4
 summary: JSON Web Token and its family (JSON Web Signature, JSON Web Encryption and
   JSON Web Key) in Ruby