eager-auth 2.2.0__tar.gz → 2.2.1__tar.gz

{eager_auth-2.2.0 → eager_auth-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: eager-auth
-Version: 2.2.0
+Version: 2.2.1
 Summary: Standard OIDC relying party for Eager FastAPI services — verification core
 Project-URL: Homepage, https://github.com/Whats-Next-CC/eager-auth
 Project-URL: Source, https://github.com/Whats-Next-CC/eager-auth
@@ -20,7 +20,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: httpx>=0.27
 Requires-Dist: joserfc>=1.0
-Requires-Dist: pyjwt[crypto]>=2.9
+Requires-Dist: pyjwt[crypto]>=2.15.0
 Provides-Extra: dev
 Requires-Dist: black>=24.0; extra == 'dev'
 Requires-Dist: fastapi>=0.110; extra == 'dev'

{eager_auth-2.2.0 → eager_auth-2.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "eager-auth"
-version = "2.2.0"
+version = "2.2.1"
 description = "Standard OIDC relying party for Eager FastAPI services — verification core"
 readme = "README.md"
 requires-python = ">=3.12"
@@ -20,7 +20,9 @@ classifiers = [
 license = "Apache-2.0"
 license-files = ["LICENSE"]
 dependencies = [
-    "pyjwt[crypto]>=2.9",
+    # 2.15.0 is the first release with no open advisory: of the thirteen published on
+    # 2026-09-29/30, 2.14.0 fixed twelve and GHSA-42vr-xj54-vc7v still affects 2.14.0.
+    "pyjwt[crypto]>=2.15.0",
     "httpx>=0.27",
     "joserfc>=1.0",
 ]

{eager_auth-2.2.0 → eager_auth-2.2.1}/src/eager_auth/tokens.py

@@ -74,7 +74,9 @@ def _header_algorithm(token: str, config: AuthConfig) -> str:
     """Read `alg` from the header and refuse anything symmetric, before touching keys."""
     try:
         header = jwt.get_unverified_header(token)
-    except jwt.InvalidTokenError as exc:
+    # RecursionError: a deeply nested header is attacker input read before any signature
+    # check, and PyJWT has let json.loads raise it unwrapped (GHSA-8wjv-2p76-3863).
+    except (jwt.InvalidTokenError, RecursionError) as exc:
         raise MalformedTokenError(f"cannot read token header: {exc}") from exc
 
     algorithm = header.get("alg")

eager_auth-2.2.1/tests/test_hostile_tokens.py

@@ -0,0 +1,30 @@
+"""Tokens built to crash the parser rather than to forge a principal.
+
+The header is read before any signature check, so whatever it contains comes from an
+unauthenticated caller. Every such token must end as a typed InvalidTokenError (a 401),
+never as an exception the framework turns into a 500.
+"""
+
+import base64
+
+import pytest
+
+from eager_auth import MalformedTokenError, verify_id_token
+
+
+def _b64(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+
+def _token_with_header(header: bytes) -> str:
+    return f"{_b64(header)}.{_b64(b'{}')}.{_b64(b'signature')}"
+
+
+@pytest.mark.parametrize("depth", [10_000, 100_000])
+def test_deeply_nested_header_is_malformed_not_a_crash(depth, config, resolver):
+    # GHSA-8wjv-2p76-3863: PyJWT 2.13.0 lets json.loads raise RecursionError here, which
+    # is a RuntimeError, not an InvalidTokenError.
+    header = b'{"alg":"RS256","x":' + b"[" * depth + b"]" * depth + b"}"
+
+    with pytest.raises(MalformedTokenError):
+        verify_id_token(_token_with_header(header), config=config, keys=resolver)