diff options
author | José Padilla <jpadilla@webapplicate.com> | 2017-06-21 16:04:35 -0400 |
---|---|---|
committer | José Padilla <jpadilla@webapplicate.com> | 2017-06-21 16:04:35 -0400 |
commit | 10b13525f51fe55872b789afa4215820d99d63dd (patch) | |
tree | 48c82d466883497f39abef333c09836cde507b14 | |
parent | 1922f0972b065077404c0dafa0946f2132400a2b (diff) | |
download | pyjwt-fix-vuln.tar.gz |
Add warning when decoding with no algorithms specifiedfix-vuln
-rw-r--r-- | jwt/api_jws.py | 6 | ||||
-rw-r--r-- | jwt/api_jwt.py | 6 | ||||
-rw-r--r-- | tests/test_api_jws.py | 10 | ||||
-rw-r--r-- | tests/test_api_jwt.py | 10 |
4 files changed, 32 insertions, 0 deletions
diff --git a/jwt/api_jws.py b/jwt/api_jws.py index 8910751..097b46a 100644 --- a/jwt/api_jws.py +++ b/jwt/api_jws.py @@ -117,6 +117,12 @@ class PyJWS(object): def decode(self, jws, key='', verify=True, algorithms=None, options=None, **kwargs): + + if not algorithms: + warnings.warn('The algorithms parameter is required when decoding. ' + + 'Please specify only the expected algorithms.', + DeprecationWarning) + payload, signing_input, header, signature = self._load(jws) if verify: diff --git a/jwt/api_jwt.py b/jwt/api_jwt.py index eef2b0f..f41f6a7 100644 --- a/jwt/api_jwt.py +++ b/jwt/api_jwt.py @@ -58,6 +58,12 @@ class PyJWT(PyJWS): def decode(self, jwt, key='', verify=True, algorithms=None, options=None, **kwargs): + + if not algorithms: + warnings.warn('The algorithms parameter is required when decoding. ' + + 'Please specify only the expected algorithms.', + DeprecationWarning) + payload, signing_input, header, signature = self._load(jwt) decoded = super(PyJWT, self).decode(jwt, key, verify, algorithms, diff --git a/tests/test_api_jws.py b/tests/test_api_jws.py index 053dd11..c90fda2 100644 --- a/tests/test_api_jws.py +++ b/tests/test_api_jws.py @@ -265,6 +265,16 @@ class TestJWS: pytest.deprecated_call(jws.decode, example_jws, verify=False) + def test_decode_with_optional_algorithms(self, jws): + example_secret = 'secret' + example_jws = ( + b'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.' + b'aGVsbG8gd29ybGQ.' + b'SIr03zM64awWRdPrAM_61QWsZchAtgDV3pphfHPPWkI' + ) + + pytest.deprecated_call(jws.decode, example_jws, key=example_secret) + def test_load_no_verification(self, jws, payload): right_secret = 'foo' jws_message = jws.encode(payload, right_secret) diff --git a/tests/test_api_jwt.py b/tests/test_api_jwt.py index 61de6e0..798e4b7 100644 --- a/tests/test_api_jwt.py +++ b/tests/test_api_jwt.py @@ -472,3 +472,13 @@ class TestJWT: secret, verify_expiration=True ) + + def test_decode_with_optional_algorithms(self, jwt, payload): + secret = 'secret' + jwt_message = jwt.encode(payload, secret) + + pytest.deprecated_call( + jwt.decode, + jwt_message, + secret + ) |