Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check varargs null values in JWTVerifier #412

Merged
merged 2 commits into from
Mar 25, 2020
Merged

Check varargs null values in JWTVerifier #412

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
da38b94
Check varargs null values in JWTVerifier
jimmyjames Mar 25, 2020
3a8cebe
Review feedback - Rename method for clarity
jimmyjames Mar 25, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 16 additions & 2 deletions lib/src/main/java/com/auth0/jwt/JWTVerifier.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ public static class BaseVerification implements Verification {

@Override
public Verification withIssuer(String... issuer) {
requireClaim(PublicClaims.ISSUER, issuer == null ? null : Arrays.asList(issuer));
requireClaim(PublicClaims.ISSUER, isNullOrEmpty(issuer) ? null : Arrays.asList(issuer));
return this;
}

Expand All @@ -69,7 +69,7 @@ public Verification withSubject(String subject) {

@Override
public Verification withAudience(String... audience) {
requireClaim(PublicClaims.AUDIENCE, audience == null ? null : Arrays.asList(audience));
requireClaim(PublicClaims.AUDIENCE, isNullOrEmpty(audience) ? null : Arrays.asList(audience));
return this;
}

Expand Down Expand Up @@ -230,6 +230,20 @@ private void requireClaim(String name, Object value) {
}
}

private static boolean isNullOrEmpty(String[] args) {
if (args == null || args.length == 0) {
return true;
}
boolean isAllNull = true;
for (String arg: args) {
if (arg != null) {
isAllNull = false;
break;
}
}
return isAllNull;
}


/**
* Perform the verification against the given Token, using any previous configured options.
Expand Down
89 changes: 86 additions & 3 deletions lib/src/test/java/com/auth0/jwt/JWTVerifierTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@
import org.junit.Test;
import org.junit.rules.ExpectedException;

import java.util.Collections;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
Expand Down Expand Up @@ -125,7 +126,7 @@ public void shouldValidateAudience() throws Exception {
.verify(tokenArr);

assertThat(jwtArr, is(notNullValue()));
}
}

@Test
public void shouldAcceptPartialAudience() throws Exception {
Expand All @@ -150,12 +151,53 @@ public void shouldThrowOnInvalidAudience() throws Exception {
.verify(token);
}

@Test
public void shouldRemoveAudienceWhenPassingNullReference() throws Exception {
Algorithm algorithm = mock(Algorithm.class);
JWTVerifier verifier = JWTVerifier.init(algorithm)
.withAudience((String) null)
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, not(hasKey("aud")));

verifier = JWTVerifier.init(algorithm)
.withAudience((String[]) null)
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, not(hasKey("aud")));

verifier = JWTVerifier.init(algorithm)
.withAudience()
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, not(hasKey("aud")));

String emptyAud = " ";
verifier = JWTVerifier.init(algorithm)
.withAudience(emptyAud)
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, hasEntry("aud", Collections.singletonList(emptyAud)));
}

@Test
public void shouldRemoveAudienceWhenPassingNull() throws Exception {
Algorithm algorithm = mock(Algorithm.class);
JWTVerifier verifier = JWTVerifier.init(algorithm)
.withAudience("John")
.withAudience(null)
.withAudience((String) null)
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, not(hasKey("aud")));

verifier = JWTVerifier.init(algorithm)
.withAudience("John")
.withAudience((String[]) null)
.build();

assertThat(verifier.claims, is(notNullValue()));
Expand Down Expand Up @@ -674,11 +716,52 @@ public void shouldRemoveClaimWhenPassingNull() throws Exception {
Algorithm algorithm = mock(Algorithm.class);
JWTVerifier verifier = JWTVerifier.init(algorithm)
.withIssuer("iss")
.withIssuer(null)
.withIssuer((String) null)
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, not(hasKey("iss")));

verifier = JWTVerifier.init(algorithm)
.withIssuer("iss")
.withIssuer((String[]) null)
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, not(hasKey("iss")));
}

@Test
public void shouldRemoveIssuerWhenPassingNullReference() throws Exception {
Algorithm algorithm = mock(Algorithm.class);
JWTVerifier verifier = JWTVerifier.init(algorithm)
.withIssuer((String) null)
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, not(hasKey("iss")));

verifier = JWTVerifier.init(algorithm)
.withIssuer((String[]) null)
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, not(hasKey("iss")));

verifier = JWTVerifier.init(algorithm)
.withIssuer()
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, not(hasKey("iss")));

String emptyIss = " ";
verifier = JWTVerifier.init(algorithm)
.withIssuer(emptyIss)
.build();

assertThat(verifier.claims, is(notNullValue()));
assertThat(verifier.claims, hasEntry("iss", Collections.singletonList(emptyIss)));
}

@Test
Expand Down