RubyGems - jwtear - Versions diffs - 1.0.5 → 1.0.6 - Mend

jwtear 1.0.5 → 1.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (12) hide show

checksums.yaml +4 -4
data/.github/workflows/gem-push.yml +42 -0
data/Gemfile.lock +22 -22
data/bin/jwtear +2 -0
data/lib/jwtear/helpers/utils.rb +4 -2
data/lib/jwtear/jwe.rb +5 -5
data/lib/jwtear/jws.rb +21 -1
data/lib/jwtear/token.rb +2 -3
data/lib/jwtear/version.rb +1 -1
data/plugins/generate.rb +1 -1
data/plugins/wiki/README.md +2 -0
metadata +4 -4

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e325882534b86402268e985372b35209081c98c9c4bf7f23534c7fa098388f5
-  data.tar.gz: cb11ceb477305198e61b56d6806df69760845cc6f12b05c1dac4f29b2a8dbb26
+  metadata.gz: 214465c3eb8ab23270f4caa51276a8af5814821515d77a29e7b17b57106a27d1
+  data.tar.gz: b9ecca972fcaa68d4729b1952b66f30aa9c6745070eb4a7261007162ed843277
 SHA512:
-  metadata.gz: a582c094d9cc6e632ef1097a9f6ea12cc441ebffd09ecbeb9be751e9e3382059a1e3546cb028defad7606336ec508f1a2441e16433a1e977e64dcfd1c1abf89d
-  data.tar.gz: edee73199d6fb13e1e0be565d6a1bac562c284258615de55f6c570379d2a42b17f41053f44725e4e38169b71f23a277eb25f66318553577008b1de091438f197
+  metadata.gz: c4af5ebfe24cef925c15c87672b1572d37858a079d0b1d4044966999637597ff699c7a1be1a50a228329619c64c9ba003c76c9dcfc8b6262647493485c23164a
+  data.tar.gz: 97544a55bc3b65a2342f083dab6a877ae4db6285d4a6187a8116ac10ce5d9f24b72ed488912a0c945c5eae04c0a3384d5f0e5f939ba482d95d00eac6dd76e5aa

data/.github/workflows/gem-push.yml ADDED Viewed

@@ -0,0 +1,42 @@
+name: Ruby Gem
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+jobs:
+  build:
+    name: Build + Publish
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: Set up Ruby 2.6
+      uses: actions/setup-ruby@v1
+      with:
+        ruby-version: 2.6.x
+    - name: Publish to GPR
+      run: |
+        mkdir -p $HOME/.gem
+        touch $HOME/.gem/credentials
+        chmod 0600 $HOME/.gem/credentials
+        printf -- "---\n:github: ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials
+        gem build *.gemspec
+        gem push --KEY github --host https://rubygems.pkg.github.com/${OWNER} *.gem
+      env:
+        GEM_HOST_API_KEY: "Bearer ${{secrets.GITHUB_TOKEN}}"
+        OWNER: ${{ github.repository_owner }}
+    - name: Publish to RubyGems
+      run: |
+        mkdir -p $HOME/.gem
+        touch $HOME/.gem/credentials
+        chmod 0600 $HOME/.gem/credentials
+        printf -- "---\n:rubygems_api_key: ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials
+        gem build *.gemspec
+        gem push *.gem
+      env:
+        GEM_HOST_API_KEY: "${{secrets.RUBYGEMS_AUTH_TOKEN}}"

data/Gemfile.lock CHANGED Viewed

@@ -1,10 +1,10 @@
 PATH
   remote: .
   specs:
-    jwtear (1.0.4)
+    jwtear (1.0.6)
       colorize (~> 0.8.1)
       gli (~> 2.19, >= 2.19.0)
-      json-jwt (~> 1.10, >= 1.10.2)
+      json-jwt (~> 1.11, >= 1.11.0)
       jwe (~> 0.4.0)
       tty-markdown (~> 0.6.0)
       tty-pager (~> 0.12.1)
@@ -12,38 +12,38 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (6.0.0)
+    activesupport (6.0.3.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
       tzinfo (~> 1.1)
-      zeitwerk (~> 2.1, >= 2.1.8)
-    aes_key_wrap (1.0.1)
-    bindata (2.4.4)
+      zeitwerk (~> 2.2, >= 2.2.2)
+    aes_key_wrap (1.1.0)
+    bindata (2.4.8)
     colorize (0.8.1)
-    concurrent-ruby (1.1.5)
+    concurrent-ruby (1.1.7)
     equatable (0.6.1)
-    gli (2.19.0)
-    i18n (1.7.0)
+    gli (2.19.2)
+    i18n (1.8.5)
       concurrent-ruby (~> 1.0)
-    json-jwt (1.10.2)
+    json-jwt (1.13.0)
       activesupport (>= 4.2)
       aes_key_wrap
       bindata
     jwe (0.4.0)
     kramdown (1.16.2)
-    minitest (5.12.2)
-    pastel (0.7.3)
+    minitest (5.14.2)
+    pastel (0.7.4)
       equatable (~> 0.6)
       tty-color (~> 0.5)
-    rouge (3.11.1)
-    strings (0.1.6)
+    rouge (3.25.0)
+    strings (0.1.8)
       strings-ansi (~> 0.1)
       unicode-display_width (~> 1.5)
       unicode_utils (~> 1.4)
-    strings-ansi (0.1.0)
+    strings-ansi (0.2.0)
     thread_safe (0.3.6)
-    tty-color (0.5.0)
+    tty-color (0.6.0)
     tty-markdown (0.6.0)
       kramdown (~> 1.16.2)
       pastel (~> 0.7.2)
@@ -55,13 +55,13 @@ GEM
       strings (~> 0.1.4)
       tty-screen (~> 0.6)
       tty-which (~> 0.4)
-    tty-screen (0.7.0)
-    tty-which (0.4.1)
-    tzinfo (1.2.5)
+    tty-screen (0.8.1)
+    tty-which (0.4.2)
+    tzinfo (1.2.8)
       thread_safe (~> 0.1)
-    unicode-display_width (1.6.0)
+    unicode-display_width (1.7.0)
     unicode_utils (1.4.0)
-    zeitwerk (2.1.10)
+    zeitwerk (2.4.1)
 PLATFORMS
   ruby
@@ -70,4 +70,4 @@ DEPENDENCIES
   jwtear!
 BUNDLED WITH
-   2.0.2
+   2.1.4

data/bin/jwtear CHANGED Viewed

@@ -58,6 +58,8 @@ module  JWTear
         print_error "Option #{exception.message}"
       when GLI::UnknownCommandArgument
         print_error "#{exception.message}"
+      when GLI::UnknownCommand
+        print_error "#{exception.message}"
       else
         print_error "Unknown Exception:"
         print_warning 'Please report the issue to: https://github.com/KINGSABRI/jwtear/issues'.underline

data/lib/jwtear/helpers/utils.rb CHANGED Viewed

@@ -19,8 +19,10 @@ module JWTear
       # read key as a string or from file(eg. pub_key.pem)
       def read_key(key)
-        if key
-          File.file?(key)? File.read(key) : key
+        if File.file?(File.absolute_path(key))
+          File.read(File.absolute_path(key))
+        else
+          key
         end
       end

data/lib/jwtear/jwe.rb CHANGED Viewed

@@ -58,10 +58,10 @@ module JWTear
       cipher_text = Base64.urlsafe_encode64(@cipher_text, padding: false)
       authentication_tag = Base64.urlsafe_encode64(@authentication_tag, padding: false)
-      "#{header.to_json}" + "●" +
-      "#{encrypted_key}"  + "●" +
-      "#{iv}"             + "●" +
-      "#{cipher_text}"    + "●" +
+      "#{header.to_json}" + ".".bold +
+      "#{encrypted_key}"  + ".".bold +
+      "#{iv}"             + ".".bold +
+      "#{cipher_text}"    + ".".bold +
       "#{authentication_tag}"
     end
@@ -78,7 +78,7 @@ module JWTear
       key = OpenSSL::PKey::RSA.new(key)
       jwt = JSON::JWT.new(JSON.parse(payload, symbolize_names: true))
       jwt.header = JSON.parse(header, symbolize_names: true)
-      ::JWE.encrypt(payload, key, enc: jwt.header[:enc]) # I had to use this gem as json-jwt does not support A192GCM AFAIK
+      ::JWE.encrypt(payload, key, enc: jwt.header[:enc]) # I had to use this gem as jwe does not support A192GCM AFAIK
     rescue TypeError => e
       print_bad "Invalid data type."
       print_warning "Make sure your public/private key file exists."

data/lib/jwtear/jws.rb CHANGED Viewed

@@ -39,7 +39,7 @@ module JWTear
     end
     def to_json_presentation
-      "#{@header.to_json}" + "●" + "#{@payload.to_json}" + "●" + "#{Base64.urlsafe_encode64(@signature, padding: false)}"
+      "#{@header.to_json}" + ".".bold + "#{@payload.to_json}" + ".".bold + "#{Base64.urlsafe_encode64(@signature, padding: false)}"
     end
     # generate_jws
@@ -59,6 +59,8 @@ module JWTear
       puts "Unexpected algorithm '#{jwt.header[:alg]}'."
       puts e.message
       exit!
+    rescue Exception => e
+      print_error e.message
     end
     private
@@ -73,6 +75,24 @@ module JWTear
         jwt.to_s
       else
         raise JSON::JWS::UnexpectedAlgorithm.new("Encryption algorithm '#{jwt.alg}' requires key.") if key.nil?
+        alg = jwt.alg.upcase
+        case
+        when alg.start_with?("HS")
+          key
+        when alg.start_with?("RS")
+          key = OpenSSL::PKey::RSA.new(key)
+        when alg.start_with?("PS")
+          key = OpenSSL::PKey::RSA.new(key)
+        when alg.start_with?("ES")
+          # key = OpenSSL::PKey::RSA.new(key)
+          print_error("Signing for ECDSA-SHA is not yet implemented")
+          print_warning 'Please report the issue to: https://github.com/KINGSABRI/jwtear/issues'.underline
+        else
+          print_warning("Undefined algorithm. This might generate a wrong token")
+          print_warning 'Please report the issue to: https://github.com/KINGSABRI/jwtear/issues'.underline
+          key
+        end
+        jwt.alg = alg.to_sym
         jwt.sign(key).to_s
       end
     end

data/lib/jwtear/token.rb CHANGED Viewed

@@ -23,10 +23,9 @@ module JWTear
         @jwe.parse(token)
       end
     rescue Exception => e
-      print_error "Unknown Exception: #{method(__method__).owner}"
+      print_error "#{method(__method__).owner}##{__method__} : Unknown Exception"
       print_warning 'Please report the issue to: https://github.com/KINGSABRI/jwtear/issues'.underline
-      puts e
-      puts e.backtrace
+      puts e.full_message
       exit!
     end

data/lib/jwtear/version.rb CHANGED Viewed

@@ -1,3 +1,3 @@
 module JWTear
-  VERSION = "1.0.5"
+  VERSION = "1.0.6"
 end

data/plugins/generate.rb CHANGED Viewed

@@ -20,7 +20,7 @@ module JWTear
       jws_cmd.desc "Key as a password string or a file public key. eg. P@ssw0rd  | eg. public_key.pem"
       jws_cmd.arg_name 'PASSWORD|PUB_KEY_FILE'
       jws_cmd.flag [:k, :key]
-      jws_cmd.action do |global, options, args|
+      jws_cmd.action do |_, options, _|
         gen = Generate.new
         puts gen.jws_token(options[:header], options[:payload], read_key(options[:key]))
       end

data/plugins/wiki/README.md CHANGED Viewed

@@ -198,6 +198,7 @@ _source(JWT, JWS and JWE for Not So Dummies! (Part I))_
 * [Pentesterlab(PRO)  - JWT X](https://pentesterlab.com/exercises/jwt_x/)
 * [Pentesterlab(PRO)  - JWT XI](https://pentesterlab.com/exercises/jwt_xi)
 * [Pentesterlab(PRO)  - JWT XII](https://pentesterlab.com/exercises/jwt_xii)
+* [Pentesterlab(PRO)  - JWT XIII](https://pentesterlab.com/exercises/jwt_iii)
 * [Pentesterlab(PRO)  - JSON Web Encryption](https://pentesterlab.com/exercises/jwe)
 * [Vulnerable JWT implementations](https://github.com/Sjord/jwtdemo)
@@ -212,3 +213,4 @@ _source(JWT, JWS and JWE for Not So Dummies! (Part I))_
 * [Damn Vulnerable Service](https://github.com/snoopysecurity/dvws)
 * [CSRF JWT redirect leak](https://gist.github.com/stefanocoding/8cdc8acf5253725992432dedb1c9c781)
 * [Critical vulnerabilities in JSON Web Token libraries](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/)
+* [JWT Attack Playbook](https://github.com/ticarpi/jwt_tool/wiki)

metadata CHANGED Viewed

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jwtear
 version: !ruby/object:Gem::Version
-  version: 1.0.5
+  version: 1.0.6
 platform: ruby
 authors:
 - KING SABRI
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-01-10 00:00:00.000000000 Z
+date: 2021-02-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: gli
@@ -115,6 +115,7 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- ".github/workflows/gem-push.yml"
 - ".gitignore"
 - CODE_OF_CONDUCT.md
 - Gemfile
@@ -156,8 +157,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project:
-rubygems_version: 2.7.6.2
+rubygems_version: 3.1.4
 signing_key:
 specification_version: 4
 summary: JWTear, a modular command-line tool to parse, create and manipulate JWT tokens