Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug] JsonWebToken.ReadToken doesn't correctly check dot 3 in JWE #2507

Closed
1 task done
pmaytak opened this issue Feb 28, 2024 · 0 comments · Fixed by #2501
Closed
1 task done

[Bug] JsonWebToken.ReadToken doesn't correctly check dot 3 in JWE #2507

pmaytak opened this issue Feb 28, 2024 · 0 comments · Fixed by #2501
Assignees
Labels
Bug Product is not functioning as expected P3 If we have time in the milestone or it just is easy when addressing a more important issue
Milestone

Comments

@pmaytak
Copy link
Contributor

pmaytak commented Feb 28, 2024

Which version of Microsoft.IdentityModel are you using?
7.4.0

Where is the issue?

  • M.IM.JsonWebTokens

Actual behavior
This check incorrectly checks if dot 3 is at the last index (in a malformed JWE). The code still works since JWE in a.b.c. format will be caught when dot 4 is checked.

if (Dot3 == encodedTokenSpan.Length) // TODO: Should this be encodedJsonSpan.Length - 1?

@pmaytak pmaytak added Bug Product is not functioning as expected P3 If we have time in the milestone or it just is easy when addressing a more important issue labels Feb 28, 2024
@pmaytak pmaytak self-assigned this Feb 28, 2024
@pmaytak pmaytak added this to the 7.4.1 milestone Feb 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug Product is not functioning as expected P3 If we have time in the milestone or it just is easy when addressing a more important issue
Projects
None yet
1 participant