Skip to content

Commit 5853d21

Browse files
mbilskiclaude
mbilski
and
claude
committed
Migrate go-jose v3 to v4
v4 requires explicit algorithm allowlists for ParseSigned, ParseEncrypted, and ParseSignedAndEncrypted. Add JOSE algorithm constants in internal/oauth2/jose_algos.go covering every standard JWS/JWE algorithm so this OAuth2 testing tool keeps working against servers regardless of their algorithm choices, and pass them at every call site. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent c2850bd commit 5853d21

11 files changed

Lines changed: 47 additions & 28 deletions

File tree

‎cmd/log.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ import (
1313
"strings"
1414

1515
"github.com/cli/browser"
16-
"github.com/go-jose/go-jose/v3"
17-
"github.com/go-jose/go-jose/v3/jwt"
16+
"github.com/go-jose/go-jose/v4"
17+
"github.com/go-jose/go-jose/v4/jwt"
1818
"github.com/go-playground/validator/v10"
1919

2020
"github.com/cloudentity/oauth2c/internal/oauth2"
@@ -316,7 +316,7 @@ func LogRequestObject(r oauth2.Request) {
316316
if token, requestClaims, err = oauth2.UnsafeParseJWT(r.RequestObject); err != nil {
317317
pterm.Error.Println(err)
318318
} else {
319-
if encryptedToken, err = jose.ParseEncrypted(request); err == nil {
319+
if encryptedToken, err = jose.ParseEncrypted(request, oauth2.JOSEKeyAlgorithms, oauth2.JOSEContentEncryption); err == nil {
320320
pterm.DefaultBox.WithTitle("Request object").Printfln("request = JWE-%s(JWT-%s(payload))", encryptedToken.Header.Algorithm, token.Headers[0].Algorithm)
321321
} else {
322322
pterm.DefaultBox.WithTitle("Request object").Printfln("request = JWT-%s(payload)", token.Headers[0].Algorithm)

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ go 1.26.0
55
require (
66
dario.cat/mergo v1.0.2
77
github.com/cli/browser v1.3.1-0.20231006085632-b393df5d7bfa
8-
github.com/go-jose/go-jose/v3 v3.0.5
8+
github.com/go-jose/go-jose/v4 v4.1.4
99
github.com/go-playground/locales v0.14.1
1010
github.com/go-playground/universal-translator v0.18.1
1111
github.com/go-playground/validator/v10 v10.30.2

‎go.sum‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
3131
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
3232
github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
3333
github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
34-
github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
35-
github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
34+
github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
35+
github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
3636
github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
3737
github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
3838
github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
@@ -41,9 +41,6 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn
4141
github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
4242
github.com/go-playground/validator/v10 v10.30.2 h1:JiFIMtSSHb2/XBUbWM4i/MpeQm9ZK2xqPNk8vgvu5JQ=
4343
github.com/go-playground/validator/v10 v10.30.2/go.mod h1:mAf2pIOVXjTEBrwUMGKkCWKKPs9NheYGabeB04txQSc=
44-
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
45-
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
46-
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
4744
github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
4845
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
4946
github.com/gookit/assert v0.1.1 h1:lh3GcawXe/p+cU7ESTZ5Ui3Sm/x8JWpIis4/1aF0mY0=
@@ -121,7 +118,6 @@ github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5t
121118
go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
122119
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
123120
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
124-
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
125121
golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
126122
golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
127123
golang.org/x/exp v0.0.0-20220909182711-5c715a9e8561 h1:MDc5xs78ZrZr3HMQugiXOAkSZtfTpbJLDr/lwfgO53E=
@@ -132,7 +128,6 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
132128
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
133129
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
134130
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
135-
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
136131
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
137132
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
138133
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -147,25 +142,20 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
147142
golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
148143
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
149144
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
150-
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
151-
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
152145
golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
153146
golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
154147
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
155148
golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
156149
golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
157150
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
158151
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
159-
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
160-
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
161152
golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
162153
golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
163154
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
164155
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
165156
golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
166157
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
167158
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
168-
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
169159
golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
170160
golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
171161
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎internal/oauth2/dpop.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import (
77
"net/http"
88
"time"
99

10-
"github.com/go-jose/go-jose/v3"
10+
"github.com/go-jose/go-jose/v4"
1111
"github.com/google/uuid"
1212
"github.com/pkg/errors"
1313
)

‎internal/oauth2/jose_algos.go‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
package oauth2
2+
3+
import jose "github.com/go-jose/go-jose/v4"
4+
5+
// JOSE v4 requires explicit algorithm allowlists for Parse* calls.
6+
// As an OAuth2 testing tool we accept every standard JWS/JWE algorithm
7+
// so users can debug servers regardless of their configuration.
8+
9+
var JOSESignatureAlgorithms = []jose.SignatureAlgorithm{
10+
jose.HS256, jose.HS384, jose.HS512,
11+
jose.RS256, jose.RS384, jose.RS512,
12+
jose.ES256, jose.ES384, jose.ES512,
13+
jose.PS256, jose.PS384, jose.PS512,
14+
jose.EdDSA,
15+
}
16+
17+
var JOSEKeyAlgorithms = []jose.KeyAlgorithm{
18+
jose.RSA1_5, jose.RSA_OAEP, jose.RSA_OAEP_256,
19+
jose.A128KW, jose.A192KW, jose.A256KW,
20+
jose.DIRECT,
21+
jose.ECDH_ES, jose.ECDH_ES_A128KW, jose.ECDH_ES_A192KW, jose.ECDH_ES_A256KW,
22+
jose.A128GCMKW, jose.A192GCMKW, jose.A256GCMKW,
23+
jose.PBES2_HS256_A128KW, jose.PBES2_HS384_A192KW, jose.PBES2_HS512_A256KW,
24+
}
25+
26+
var JOSEContentEncryption = []jose.ContentEncryption{
27+
jose.A128CBC_HS256, jose.A192CBC_HS384, jose.A256CBC_HS512,
28+
jose.A128GCM, jose.A192GCM, jose.A256GCM,
29+
}

‎internal/oauth2/jwe.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ package oauth2
33
import (
44
"net/http"
55

6-
"github.com/go-jose/go-jose/v3"
6+
"github.com/go-jose/go-jose/v4"
77
"github.com/pkg/errors"
88
)
99

‎internal/oauth2/jwk.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import (
88
"os"
99
"strings"
1010

11-
"github.com/go-jose/go-jose/v3"
11+
"github.com/go-jose/go-jose/v4"
1212
"github.com/pkg/errors"
1313
)
1414

‎internal/oauth2/jwt.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,8 @@ import (
77
"net/url"
88
"time"
99

10-
"github.com/go-jose/go-jose/v3"
11-
"github.com/go-jose/go-jose/v3/jwt"
10+
"github.com/go-jose/go-jose/v4"
11+
"github.com/go-jose/go-jose/v4/jwt"
1212
"github.com/pkg/errors"
1313
)
1414

@@ -19,7 +19,7 @@ func UnsafeParseJWT(token string) (*jwt.JSONWebToken, map[string]interface{}, er
1919
err error
2020
)
2121

22-
if t, err = jwt.ParseSigned(token); err != nil {
22+
if t, err = jwt.ParseSigned(token, JOSESignatureAlgorithms); err != nil {
2323
return nil, nil, err
2424
}
2525

‎internal/oauth2/jwt_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import (
55
"net/http"
66
"testing"
77

8-
"github.com/go-jose/go-jose/v3"
8+
"github.com/go-jose/go-jose/v4"
99
"github.com/stretchr/testify/require"
1010
)
1111

@@ -26,7 +26,7 @@ func TestSignJWT(t *testing.T) {
2626
jwt, _, err := SignJWT(claims, JWKSigner("../../data/rsa/key.json", http.DefaultClient))
2727
require.NoError(t, err)
2828

29-
jws, err := jose.ParseSigned(jwt)
29+
jws, err := jose.ParseSigned(jwt, JOSESignatureAlgorithms)
3030
require.NoError(t, err)
3131

3232
bs, err := jws.Verify(key.Public())

‎internal/oauth2/oauth2.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ import (
1515
"strings"
1616
"time"
1717

18-
"github.com/go-jose/go-jose/v3"
18+
"github.com/go-jose/go-jose/v4"
1919
"github.com/pkg/errors"
2020
)
2121

0 commit comments

Comments
 (0)