hyperscale-stack / security
98%
master: 98%

LAST BUILD BRANCH: dependabot/go_modules/github.com/chromedp/cdproto-0.158.4
DEFAULT BRANCH: master
Repo Added
Token eXsCYvUeMzR6iIXtqrlWZXFVqTZ43wOX2 regen
Build 259 Last
Files 224
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH fix/audit2-jose
branch: fix/audit2-jose
CHANGE BRANCH
x
Sync Branches

coverage: 98.49% (-0.003%) from 98.493%
39580969522

Pull #123

github

euskadi31 
fix(jwt,oidc/provider)!: refuse to publish RSA keys over 4096 bits

A JWK Set holding one RSA key over 4096 bits is refused as a whole by
go-jose v4.1.6's JSONWebKeySet, which go-oidc relying parties use. This
library's own key sets ignore that key instead. Signing keys over 4096
bits were already refused, but such a key could still be published:
- through jwtsec.MarshalJWKS;
- as an oidcprovider.KeyRing.Published "next key", which then broke the
  logins of those relying parties. Promoting it to signing then made the
  ring invalid on every request.

MarshalJWKS (ErrInvalidKey) and KeyRing.Validate (ErrInvalidKeyRing) now
refuse it. PublicKey.Validate and NewStaticJWKS stay unbounded.

The docs are corrected:
- a larger key is ignored by this library's key sets and refused, with
  its whole JWK Set, by go-jose's JSONWebKeySet;
- the RFC 7515 section list no longer spans kid (section 4.1.4);
- the error-precedence change (jwk with a disallowed algorithm) is in
  MIGRATION;
- the oidc-client conformance row lists the header check;
- several paragraphs are reflowed.

BREAKING CHANGE: an RSA key over 4096 bits passed to jwtsec.MarshalJWKS
or listed in oidcprovider.KeyRing.Published is refused.

Audit: F-01.
Pull Request #123: fix(jwt,oidc): refuse key-bearing JOSE headers, upgrade go-jose to v4.1.6

42 of 42 new or added lines in 4 files covered. (100.0%)

1 existing line in 1 file now uncovered.

13896 of 14109 relevant lines covered (98.49%)

4976.81 hits per line

Relevant lines Covered
14109 RELEVANT LINES 13896 COVERED LINES
4976.81 HITS PER LINE
Source Files on fix/audit2-jose

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
39580969522 fix/audit2-jose fix(jwt,oidc/provider)!: refuse to publish RSA keys over 4096 bits A JWK Set holding one RSA key over 4096 bits is refused as a whole by go-jose v4.1.6's JSONWebKeySet, which go-oidc relying parties use. This library's own key sets ignore that ke... Pull #123 euskadi31 github
98.49
39570823532 fix/audit2-jose docs: document refused JOSE key headers and the 4096-bit RSA bound CHANGELOG (Security, Changed, Fixed), a MIGRATION section with its before/after table and steps, LIMITATIONS and the security considerations now describe the go-jose v4.1.6 upgrad... Pull #123 euskadi31 github
98.49
See All Builds (259)

Badge your Repo: security

We detected this repo isn’t badged! Grab the embed code to the right, add it to your repo to show off your code coverage, and when the badge is live hit the refresh button to remove this message.
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

Refresh