jwt 1.5.5 → 1.5.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 0ab60d996890a0c93b46c4c86170e03fbfdca0c2
-  data.tar.gz: 83765101b7357c3c548bad68baeff603b83ce446
+  metadata.gz: 8cd1a9ca017dec28c4984e18003e8ae58aee776c
+  data.tar.gz: c5fef77f9a8e42d8fa92c060c468be6ee2e3c561
 SHA512:
-  metadata.gz: bab32a2372d9a05d4f5b8591c77cb9be60c252b796b778c417a5ad9a2f87a7faae3421029b07543c06f3f7bdf5ad2c786776f6f45a93dca7e128f6753ce143dd
-  data.tar.gz: 1dd7005d75ff1a20cfc95e9362a48776bcc498f26ba4362f027252e32d32dcd30f8a50045fbb85da5486d231c63aaa043b20101169ee1fecf702dee2e95483c8
+  metadata.gz: c0dc92b0ea35004782c8260f8d2d47c9973a1172f5eb6bef33fe42ae3a2e8341c9264e5fafc7cb62442039409194c3aa6fbd3db78667db75af04ffd26586422f
+  data.tar.gz: af9967d4c04b332ef8916d3b837e31c20b2e5db8c96531b277286324f29730edbc65eb66401f6db405b22dbd2701895d2579796fab368c26bd1fca58aae30840

data/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Change Log
 
+## [v1.5.6](https://github.com/jwt/ruby-jwt/tree/v1.5.6) (2016-09-19)
+[Full Changelog](https://github.com/jwt/ruby-jwt/compare/v1.5.5...v1.5.6)
+
+**Fixed bugs:**
+
+- Fix missing symbol handling in aud verify code [\#166](https://github.com/jwt/ruby-jwt/pull/166) ([excpt](https://github.com/excpt))
+
+**Merged pull requests:**
+
+- Fix rubocop code smells [\#167](https://github.com/jwt/ruby-jwt/pull/167) ([excpt](https://github.com/excpt))
+
 ## [v1.5.5](https://github.com/jwt/ruby-jwt/tree/v1.5.5) (2016-09-16)
 [Full Changelog](https://github.com/jwt/ruby-jwt/compare/v1.5.4...v1.5.5)
 

data/lib/jwt.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'base64'
 require 'openssl'
 require 'jwt/decode'
@@ -17,6 +18,17 @@ module JWT
     'secp521r1' => 'ES512'
   }.freeze
 
+  DEFAULT_OPTIONS = {
+    verify_expiration: true,
+    verify_not_before: true,
+    verify_iss: false,
+    verify_iat: false,
+    verify_jti: false,
+    verify_aud: false,
+    verify_sub: false,
+    leeway: 0
+  }.freeze
+
   module_function
 
   def sign(algorithm, msg, key)
@@ -73,7 +85,7 @@ module JWT
   end
 
   def encoded_payload(payload)
-    raise InvalidPayload, "exp claim must be an integer" if payload['exp'] && payload['exp'].is_a?(Time)
+    raise InvalidPayload, 'exp claim must be an integer' if payload['exp'] && payload['exp'].is_a?(Time)
     base64url_encode(encode_json(payload))
   end
 
@@ -98,51 +110,19 @@ module JWT
   def decoded_segments(jwt, key = nil, verify = true, custom_options = {}, &keyfinder)
     raise(JWT::DecodeError, 'Nil JSON web token') unless jwt
 
-    options = {
-      verify_expiration: true,
-      verify_not_before: true,
-      verify_iss: false,
-      verify_iat: false,
-      verify_jti: false,
-      verify_aud: false,
-      verify_sub: false,
-      leeway: 0
-    }
-
-    merged_options = options.merge(custom_options)
+    merged_options = DEFAULT_OPTIONS.merge(custom_options)
 
     decoder = Decode.new jwt, key, verify, merged_options, &keyfinder
     decoder.decode_segments
   end
 
-
   def decode(jwt, key = nil, verify = true, custom_options = {}, &keyfinder)
     raise(JWT::DecodeError, 'Nil JSON web token') unless jwt
 
-    options = {
-      verify_expiration: true,
-      verify_not_before: true,
-      verify_iss: false,
-      verify_iat: false,
-      verify_jti: false,
-      verify_aud: false,
-      verify_sub: false,
-      leeway: 0
-    }
-
-    merged_options = options.merge(custom_options)
-
+    merged_options = DEFAULT_OPTIONS.merge(custom_options)
     decoder = Decode.new jwt, key, verify, merged_options, &keyfinder
     header, payload, signature, signing_input = decoder.decode_segments
-
-    if verify
-      algo, key = signature_algorithm_and_key(header, key, &keyfinder)
-      if merged_options[:algorithm] && algo != merged_options[:algorithm]
-        raise JWT::IncorrectAlgorithm, 'Expected a different algorithm'
-      end
-      verify_signature(algo, key, signing_input, signature)
-    end
-
+    decode_verify_signature(key, header, signature, signing_input, merged_options, &keyfinder) if verify
     decoder.verify
 
     raise(JWT::DecodeError, 'Not enough or too many segments') unless header && payload
@@ -150,12 +130,28 @@ module JWT
     [payload, header]
   end
 
+  def decode_verify_signature(key, header, signature, signing_input, options, &keyfinder)
+    algo, key = signature_algorithm_and_key(header, key, &keyfinder)
+    if options[:algorithm] && algo != options[:algorithm]
+      raise JWT::IncorrectAlgorithm, 'Expected a different algorithm'
+    end
+    verify_signature(algo, key, signing_input, signature)
+  end
+
   def signature_algorithm_and_key(header, key, &keyfinder)
     key = yield(header) if keyfinder
     [header['alg'], key]
   end
 
   def verify_signature(algo, key, signing_input, signature)
+    verify_signature_algo(algo, key, signing_input, signature)
+  rescue OpenSSL::PKey::PKeyError
+    raise JWT::VerificationError, 'Signature verification raised'
+  ensure
+    OpenSSL.errors.clear
+  end
+
+  def verify_signature_algo(algo, key, signing_input, signature)
     if %w(HS256 HS384 HS512).include?(algo)
       raise(JWT::VerificationError, 'Signature verification raised') unless secure_compare(signature, sign_hmac(algo, signing_input, key))
     elsif %w(RS256 RS384 RS512).include?(algo)
@@ -165,10 +161,6 @@ module JWT
     else
       raise JWT::VerificationError, 'Algorithm not supported'
     end
-  rescue OpenSSL::PKey::PKeyError
-    raise JWT::VerificationError, 'Signature verification raised'
-  ensure
-    OpenSSL.errors.clear
   end
 
   # From devise
@@ -179,7 +171,7 @@ module JWT
 
     res = 0
     b.each_byte { |byte| res |= byte ^ l.shift }
-    res == 0
+    res.zero?
   end
 
   def raw_to_asn1(signature, private_key)

data/lib/jwt/decode.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'jwt/json'
 require 'jwt/verify'
 
@@ -28,7 +29,7 @@ module JWT
     def raw_segments(jwt, verify)
       segments = jwt.split('.')
       required_num_segments = verify ? [3] : [2, 3]
-      fail(JWT::DecodeError, 'Not enough or too many segments') unless required_num_segments.include? segments.length
+      raise(JWT::DecodeError, 'Not enough or too many segments') unless required_num_segments.include? segments.length
       segments
     end
     private :raw_segments
@@ -47,7 +48,7 @@ module JWT
 
     def verify
       @options.each do |key, val|
-        next unless key.to_s.match(/verify/)
+        next unless key.to_s =~ /verify/
 
         Verify.send(key, payload, @options) if val
       end

data/lib/jwt/error.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 module JWT
   class DecodeError < StandardError; end
   class VerificationError < DecodeError; end

data/lib/jwt/json.rb

@@ -1,3 +1,4 @@
+# frozen_string_literal: true
 require 'json'
 
 module JWT

data/lib/jwt/verify.rb

@@ -21,19 +21,7 @@ module JWT
       return unless (options_aud = extract_option(:aud))
 
       if @payload['aud'].is_a?(Array)
-        if options_aud.is_a?(Array)
-          options_aud.each do |aud|
-            raise(
-              JWT::InvalidAudError,
-              'Invalid audience'
-            ) unless @payload['aud'].include?(aud)
-          end
-        else
-          raise(
-            JWT::InvalidAudError,
-            'Invalid audience'
-          ) unless @payload['aud'].include?(options_aud)
-        end
+        verify_aud_array(@payload['aud'], options_aud)
       else
         raise(
           JWT::InvalidAudError,
@@ -42,6 +30,16 @@ module JWT
       end
     end
 
+    def verify_aud_array(audience, options_aud)
+      if options_aud.is_a?(Array)
+        options_aud.each do |aud|
+          raise(JWT::InvalidAudError, 'Invalid audience') unless audience.include?(aud.to_s)
+        end
+      else
+        raise(JWT::InvalidAudError, 'Invalid audience') unless audience.include?(options_aud.to_s)
+      end
+    end
+
     def verify_expiration
       return unless @payload.include?('exp')
 

data/lib/jwt/version.rb

@@ -1,4 +1,5 @@
 # encoding: utf-8
+# frozen_string_literal: true
 
 # Moments version builder module
 module JWT
@@ -13,9 +14,9 @@ module JWT
     # minor version
     MINOR = 5
     # tiny version
-    TINY  = 5
+    TINY  = 6
     # alpha, beta, etc. tag
-    PRE   = nil 
+    PRE   = nil
 
     # Build version string
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

data/spec/jwt/verify_spec.rb

@@ -46,6 +46,19 @@ module JWT
       it 'must allow an array with any value matching the one in the options with a string options key' do
         Verify.verify_aud(array_payload, options.merge('aud' => array_aud.first))
       end
+
+      it 'should allow strings or symbolds in options array' do
+        options['aud'] = [
+          'ruby-jwt-aud', 
+          'test-aud',
+          'ruby-ruby-ruby',
+          :test
+        ]
+
+        array_payload['aud'].push('test')
+        
+        Verify.verify_aud(array_payload, options)
+      end
     end
 
     context '.verify_expiration(payload, options)' do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jwt
 version: !ruby/object:Gem::Version
-  version: 1.5.5
+  version: 1.5.6
 platform: ruby
 authors:
 - Jeff Lindsay
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-09-16 00:00:00.000000000 Z
+date: 2016-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler