fix: ensure JWT segments have the right types

[ret2libc]

Function _unverified_decode assumes header is a dict and performs a .get("alg") after decoding the JWT token, however the header may be a different object which does not have the get method. Similar problem for the payload segment, which is accessed as a dictionary but there is no check for it.

This PR fixes the problem by checking the type of header/payload in the _unverified_decode function.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[clundin25]

Minor comments, otherwise LGTM.

Thank you for your contribution!

[clundin25]

Hi @ret2libc,

In order for the tests to pass can you merge clundin25@17cc33f? Alternatively, I can push it to your branch if you give me write permissions to your fork.

Thanks!

[ret2libc]

Hi @ret2libc,

In order for the tests to pass can you merge clundin25@17cc33f? Alternatively, I can push it to your branch if you give me write permissions to your fork.

Thanks!

Done!

[clundin25]

Hi @ret2libc,

Sorry for the delay, I was OOTO. Can you sync your branch? Sorry for the toil.

[ret2libc]

@clundin25 done!

[clundin25]

No need to apologize @ret2libc, we appreciate your contribution and I apologize for the system test churn.

Here is a fresh token. b691524

[ret2libc]

I have used your new commit. Also, I don't see any test failure locally. Let's see the CI :)

[ret2libc]

Oh, I see. It's python2. Will have a fix by EOD.

[ret2libc]

@clundin25 do you have any idea what's going on now?

[clundin25]

Sorry for the delay. @ret2libc looks like the formatter choked.

This patch should resolve it.

clundin25@bc02d36

[clundin25]

Thanks again for your contribution!