Allow parameterized application/json content types

pkg/api/ca.go

@@ -23,6 +23,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"mime"
 	"net/http"
 	"strings"
 
@@ -110,14 +111,26 @@ func actualAuthorize(req *http.Request) (*oidc.IDToken, error) {
 	return verifier.Verify(req.Context(), token)
 }
 
+func verifyContentType(contentType string) error {
+	gotContentType, _, perr := mime.ParseMediaType(contentType)
+	if perr != nil {
+		return fmt.Errorf("could not parse Content-Type %q", contentType)
+	}
+	wantContentType := "application/json"
+	if gotContentType != wantContentType {
+		return fmt.Errorf("signing cert handler must receive %q, got %q", wantContentType, gotContentType)
+	}
+	return nil
+}
+
 func (a *api) signingCert(w http.ResponseWriter, req *http.Request) {
 	if req.Method != http.MethodPost {
 		err := fmt.Errorf("signing cert handler must receive POSTs, got %s", req.Method)
 		handleFulcioAPIError(w, req, http.StatusMethodNotAllowed, err, err.Error())
 		return
 	}
-	if gotContentType, wantContentType := req.Header.Get("Content-Type"), "application/json"; gotContentType != wantContentType {
-		err := fmt.Errorf("signing cert handler must receive %q, got %q", wantContentType, gotContentType)
+
+	if err := verifyContentType(req.Header.Get("Content-Type")); err != nil {
 		handleFulcioAPIError(w, req, http.StatusUnsupportedMediaType, err, err.Error())
 		return
 	}

pkg/api/ca_test.go

@@ -0,0 +1,42 @@
+// Copyright 2022 The Sigstore Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+package api
+
+import "testing"
+
+func TestVerifyContentType(t *testing.T) {
+	testCases := []struct {
+		contentType string
+		shouldPass  bool
+	}{
+		{"application/json", true},
+		{"application/json; charset=UTF-8", true},
+		{"application/unsupported", false},
+		{"some nonsense", false},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.contentType, func(t *testing.T) {
+			err := verifyContentType(tc.contentType)
+			if err != nil && tc.shouldPass {
+				t.Fatalf("Expected no error but got %q", err)
+			}
+			if err == nil && !tc.shouldPass {
+				t.Fatalf("Expected error but got none")
+			}
+		})
+	}
+}