crash on absent key id during exception handling

[Zil0-eo]

This has been introduced by 0edf66d in 0.9:

--- a/jwcrypto/jwt.py
+++ b/jwcrypto/jwt.py
@@ -489,7 +489,7 @@ class JWT(object):
                         self.deserializelog.append("Success")
                         break
                     except Exception as e:  # pylint: disable=broad-except
-                        keyid = k.key_id
+                        keyid = k['kid']
                         if keyid is None:

The property key_id returned None if key had no key id, but this made 'kid' mandatory.

The bug happens whenever an exception is raised during deserialization with such key. For example, a call to JWT(jwt=jwt, key=key, algs=['RS256', 'ES256']) with an ES256 key will trigger it, as the first attempt to use key as a RS256 key raises an exception.

[simo5]

Good catch!

[simo5]

Do you have a reproducer?
I am trying to write a test, bu I cannot cause it to crash.

[simo5]

Nevermind, got it.