From 0fdf78d4dbf609455f3277d6169a987aef0384d4 Mon Sep 17 00:00:00 2001 From: Jakub Mikulas Date: Mon, 30 Mar 2015 19:29:25 +0200 Subject: [PATCH 1/4] Prevent throw on undefined/null secret --- index.js | 3 +++ test/undefined_secretOrPublickey.tests.js | 21 +++++++++++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 test/undefined_secretOrPublickey.tests.js diff --git a/index.js b/index.js index 1c04474a..c20ba4ba 100644 --- a/index.js +++ b/index.js @@ -107,6 +107,9 @@ module.exports.verify = function(jwtString, secretOrPublicKey, options, callback return done(new JsonWebTokenError('jwt signature is required')); } + if (typeof secretOrPublicKey === "undefined" || secretOrPublicKey === null) // secretOrPublicKey can be empty string + return done(new JsonWebTokenError('secret or publick key must be provided')); + if (!options.algorithms) { options.algorithms = ~secretOrPublicKey.toString().indexOf('BEGIN CERTIFICATE') || ~secretOrPublicKey.toString().indexOf('BEGIN PUBLIC KEY') ? diff --git a/test/undefined_secretOrPublickey.tests.js b/test/undefined_secretOrPublickey.tests.js new file mode 100644 index 00000000..75e9724c --- /dev/null +++ b/test/undefined_secretOrPublickey.tests.js @@ -0,0 +1,21 @@ +var fs = require('fs'); +var path = require('path'); +var jwt = require('../index'); +var JsonWebTokenError = require('../lib/JsonWebTokenError'); +var expect = require('chai').expect; + +var TOKEN = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.e30.t-IDcSemACt8x4iTMCda8Yhe3iZaWbvV5XKSTbuAn0M'; + +describe('verifying without specified secret or public key', function () { + it('should not verify null', function () { + expect(function () { + jwt.verify(TOKEN, null); + }).to.throw(JsonWebTokenError, /secret or publick key must be provided/); + }); + + it('should not verify undefined', function () { + expect(function () { + jwt.verify(TOKEN); + }).to.throw(JsonWebTokenError, /secret or publick key must be provided/); + }); +}); \ No newline at end of file From d6240e24186732d368bffe21143becf44c38f0d6 Mon Sep 17 00:00:00 2001 From: Jakub Mikulas Date: Mon, 30 Mar 2015 19:30:35 +0200 Subject: [PATCH 2/4] Removed path from test --- test/undefined_secretOrPublickey.tests.js | 1 - 1 file changed, 1 deletion(-) diff --git a/test/undefined_secretOrPublickey.tests.js b/test/undefined_secretOrPublickey.tests.js index 75e9724c..9e470bab 100644 --- a/test/undefined_secretOrPublickey.tests.js +++ b/test/undefined_secretOrPublickey.tests.js @@ -1,5 +1,4 @@ var fs = require('fs'); -var path = require('path'); var jwt = require('../index'); var JsonWebTokenError = require('../lib/JsonWebTokenError'); var expect = require('chai').expect; From ffe68dbe0219bab535c1018448eb4c0b22f1f902 Mon Sep 17 00:00:00 2001 From: Jakub Mikulas Date: Tue, 21 Apr 2015 13:06:24 +0200 Subject: [PATCH 3/4] Typo --- index.js | 2 +- test/undefined_secretOrPublickey.tests.js | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/index.js b/index.js index c20ba4ba..37dd0c5a 100644 --- a/index.js +++ b/index.js @@ -108,7 +108,7 @@ module.exports.verify = function(jwtString, secretOrPublicKey, options, callback } if (typeof secretOrPublicKey === "undefined" || secretOrPublicKey === null) // secretOrPublicKey can be empty string - return done(new JsonWebTokenError('secret or publick key must be provided')); + return done(new JsonWebTokenError('secret or public key must be provided')); if (!options.algorithms) { options.algorithms = ~secretOrPublicKey.toString().indexOf('BEGIN CERTIFICATE') || diff --git a/test/undefined_secretOrPublickey.tests.js b/test/undefined_secretOrPublickey.tests.js index 9e470bab..01132ad9 100644 --- a/test/undefined_secretOrPublickey.tests.js +++ b/test/undefined_secretOrPublickey.tests.js @@ -9,12 +9,12 @@ describe('verifying without specified secret or public key', function () { it('should not verify null', function () { expect(function () { jwt.verify(TOKEN, null); - }).to.throw(JsonWebTokenError, /secret or publick key must be provided/); + }).to.throw(JsonWebTokenError, /secret or public key must be provided/); }); it('should not verify undefined', function () { expect(function () { jwt.verify(TOKEN); - }).to.throw(JsonWebTokenError, /secret or publick key must be provided/); + }).to.throw(JsonWebTokenError, /secret or public key must be provided/); }); }); \ No newline at end of file From f1cffd033bffc44f20558eda4a797c3fa2f4ee05 Mon Sep 17 00:00:00 2001 From: Jakub Mikulas Date: Wed, 22 Apr 2015 16:20:44 +0200 Subject: [PATCH 4/4] Simplified checking for missing key --- index.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/index.js b/index.js index 37dd0c5a..6b0be788 100644 --- a/index.js +++ b/index.js @@ -107,8 +107,9 @@ module.exports.verify = function(jwtString, secretOrPublicKey, options, callback return done(new JsonWebTokenError('jwt signature is required')); } - if (typeof secretOrPublicKey === "undefined" || secretOrPublicKey === null) // secretOrPublicKey can be empty string + if (!secretOrPublicKey) { return done(new JsonWebTokenError('secret or public key must be provided')); + } if (!options.algorithms) { options.algorithms = ~secretOrPublicKey.toString().indexOf('BEGIN CERTIFICATE') ||