Repository navigation
fix: handle malformed JWT encoding - #304
marco-a-affinidi wants to merge 1 commit into
Conversation
|
Coverage after merging fix/malformed_jwt_exceptions into main will be
Coverage Report |
🛡️ AI Agentic Security Code Review1 AI-confirmed issue. Mandatory to check: 🔒 Security Code Review Report — Security tab ↗ 📊 Summary & findings
Finding details (titles, evidence + remediation) are in the 🔒 Security tab ↗ — visible to maintainers / code owners only. |
| return false; | ||
| } | ||
|
|
||
| final jws = decode(input.serialized); |
There was a problem hiding this comment.
Should we also handle malformed input.serialized here?
| base64UrlNoPadDecode(segments[1]), | ||
| ), | ||
| ) as Map<String, dynamic>; | ||
| final header = _decodeJsonSegment(segments[0], 'header'); |
There was a problem hiding this comment.
Same here for header and payload, should we handle malformed data? So the main question is, if we handle a malformed signature, should we handle the other JWT parts? Can base64UrlNoPadDecode, _decodeJsonSegment, and other decoding methods so they throw SSI exception. In this case, we don't have to wrap try catch here and just allow them to throw exceptions from decoders.
This pull request introduces improved error handling for JWT parsing and verification, ensuring that malformed JWTs and invalid encodings are consistently rejected with typed exceptions. It also adds comprehensive tests to validate these behaviors. The main changes are grouped into error handling improvements in the core logic and expanded test coverage.
Error handling improvements:
JwtParserto use a new_decodeJsonSegmenthelper, which throws a typedSsiExceptionif a JWT header or payload is not valid base64url or not a JSON object. [1] [2]JwtDm1Suite.verifyIntegrityto catch and rethrow signature decoding errors asSsiExceptionwith an explicit error code for invalid encoding.JwtDm1Suite.verifyIntegrityby using the parsed JWS header directly, improving consistency.dart:typed_datato support stricter type handling.Test coverage:
jwt_parser_test.dartto verify that malformed JWTs (invalid base64url, non-object JSON headers or payloads) are rejected with the correct typed exception.jwt_header_jwk_validation_test.dartto ensureverifyIntegrityrejects malformed serialized JWT input with a typed exception.