Merge branch 'development'

noha · noha · commit bc584c02356e · 2022-09-29T14:38:50.000+02:00
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -0,0 +1,28 @@
+name: CI
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+# Controls when the action will run. Triggers the workflow on push or pull request
+# events but only for the development branch
+on:
+  pull_request:
+    types: [assigned, opened, synchronize, reopened]
+    
+  push:
+    branches:
+      - development
+  
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: hpi-swa/setup-smalltalkCI@v1
+        id: smalltalkci
+        with:
+          smalltalk-version: Pharo64-9.0
+      - run: smalltalkci -s ${{ steps.smalltalkci.outputs.smalltalk-version }}
+        shell: bash
+        timeout-minutes: 15
diff --git a/.travis.yml b/.travis.yml
diff --git a/source/BaselineOfJSONWebToken.package/BaselineOfJSONWebToken.class/instance/baseline..st b/source/BaselineOfJSONWebToken.package/BaselineOfJSONWebToken.class/instance/baseline..st
@@ -8,7 +8,7 @@ baseline: spec
 				with: [ spec repository: 'github://svenvc/NeoJSON:master/repository' ].
 			spec
 				baseline: 'OpenSSL'
-				with: [ spec repository: 'github://PierceNg/OpenSSL-Pharo/src-st' ].
+				with: [ spec repository: 'github://PierceNg/OpenSSL-Pharo:openssl_1_1_pharo9/src-st' ].
 			spec
 				package: #'JSONWebToken-Core'
 					with: [ spec requires: #('NeoJSON') ];
diff --git a/source/JSONWebToken-Core-Tests.package/JSONWebTokenTest.class/instance/simpleJsonWebSignature.st b/source/JSONWebToken-Core-Tests.package/JSONWebTokenTest.class/instance/simpleJsonWebSignature.st
@@ -0,0 +1,7 @@
+as yet unclassified
+simpleJsonWebSignature
+	^ JsonWebSignature new
+			algorithmName: 'HS256';
+			payload: (JWTClaimsSet new
+				at: 'bar' put: 'foo');
+			key: 'foobar'
diff --git a/source/JSONWebToken-Core-Tests.package/JSONWebTokenTest.class/instance/simpleTokenString.st b/source/JSONWebToken-Core-Tests.package/JSONWebTokenTest.class/instance/simpleTokenString.st
@@ -0,0 +1,3 @@
+as yet unclassified
+simpleTokenString
+	^ self simpleJsonWebSignature compactSerialized.
diff --git a/source/JSONWebToken-Core-Tests.package/JSONWebTokenTest.class/instance/testDecodingThreeParts.st b/source/JSONWebToken-Core-Tests.package/JSONWebTokenTest.class/instance/testDecodingThreeParts.st
@@ -0,0 +1,8 @@
+tests
+testDecodingThreeParts 
+	| tokenString invalid |
+	tokenString := self simpleTokenString.
+	invalid := $. join: ($. split: tokenString) allButLast.
+	self 
+		should: [ JsonWebSignature materializeCompact: invalid key: 'foobar' ]
+		raise: JWSInvalidTokenFormat.
diff --git a/source/JSONWebToken-Core.package/JWAHMACSHA256.class/class/checkSignatureOfParts.withKey..st b/source/JSONWebToken-Core.package/JWAHMACSHA256.class/class/checkSignatureOfParts.withKey..st
@@ -1,5 +1,5 @@
 sign
-checkSignature: parts withKey: key
+checkSignatureOfParts: parts withKey: key
 	(self
 		signMessage:
 			($.
diff --git a/source/JSONWebToken-Core.package/JWANone.class/class/checkSignature.withKey..st b/source/JSONWebToken-Core.package/JWANone.class/class/checkSignature.withKey..st
diff --git a/source/JSONWebToken-Core.package/JWANone.class/class/checkSignatureOfParts.withKey..st b/source/JSONWebToken-Core.package/JWANone.class/class/checkSignatureOfParts.withKey..st
@@ -0,0 +1,3 @@
+sign
+checkSignatureOfParts: parts withKey: key
+	
diff --git a/source/JSONWebToken-Core.package/JWSCompactSerializer.class/instance/materialize.key.checkSignature..st b/source/JSONWebToken-Core.package/JWSCompactSerializer.class/instance/materialize.key.checkSignature..st
@@ -4,10 +4,11 @@ materialize: aString key: aKeyString checkSignature: checkSignature
 	| parts header jws |
 
 	parts := $. split: aString.
-	header := JWSHeader fromJson: ( self base64Decoded: parts first ) asString.
+	(parts size = 3) ifFalse: [ JWSInvalidTokenFormat signal: 'the format of the token is invalid' ].
+	header := JWSHeader fromJson: ( self class base64UrlDecoded: parts first ) utf8Decoded.
 	jws := JsonWebSignature new
 		key: aKeyString;
 		setProtectedHeader: header.
 	checkSignature
 		ifTrue: [ jws checkSignature: parts ].
-	^ jws payload: ( JWTClaimsSet fromJson: ( self base64Decoded: parts second ) asString )
+	^ jws payload: ( JWTClaimsSet fromJson: ( self class base64UrlDecoded: parts second ) utf8Decoded )
diff --git a/source/JSONWebToken-Core.package/JWSCompactSerializer.class/instance/serialize..st b/source/JSONWebToken-Core.package/JWSCompactSerializer.class/instance/serialize..st
@@ -8,5 +8,5 @@ serialize: aWebSignature
 	signature := aWebSignature signatureFor: stream contents.
 	stream
 		nextPut: $.;
-		nextPutAll: (self base64Encoded: signature).
+		nextPutAll: (self class base64UrlEncoded: signature).
 	^ stream contents
diff --git a/source/JSONWebToken-Core.package/JWSCompactSerializer.class/instance/writeHeader..st b/source/JSONWebToken-Core.package/JWSCompactSerializer.class/instance/writeHeader..st
@@ -1,3 +1,3 @@
 writing
 writeHeader: aHeader 
-	stream nextPutAll: (self base64Encoded: aHeader asJson asByteArray) 
+	stream nextPutAll: (self class base64UrlEncoded: aHeader asJson asByteArray) 
diff --git a/source/JSONWebToken-Core.package/JWSCompactSerializer.class/instance/writePayload..st b/source/JSONWebToken-Core.package/JWSCompactSerializer.class/instance/writePayload..st
@@ -1,3 +1,3 @@
 writing
 writePayload: anObject
-	stream nextPutAll: (self base64Encoded: anObject asJson asByteArray) 
+	stream nextPutAll: (self class base64UrlEncoded: anObject asJson utf8Encoded) 
diff --git a/source/JSONWebToken-Core.package/JWSInvalidTokenFormat.class/README.md b/source/JSONWebToken-Core.package/JWSInvalidTokenFormat.class/README.md
diff --git a/source/JSONWebToken-Core.package/JWSInvalidTokenFormat.class/properties.json b/source/JSONWebToken-Core.package/JWSInvalidTokenFormat.class/properties.json
@@ -0,0 +1,11 @@
+{
+	"commentStamp" : "",
+	"super" : "Error",
+	"category" : "JSONWebToken-Core-Serialization",
+	"classinstvars" : [ ],
+	"pools" : [ ],
+	"classvars" : [ ],
+	"instvars" : [ ],
+	"name" : "JWSInvalidTokenFormat",
+	"type" : "normal"
+}
diff --git a/source/JSONWebToken-Core.package/JWSSerializer.class/class/base64UrlDecoded..st b/source/JSONWebToken-Core.package/JWSSerializer.class/class/base64UrlDecoded..st
@@ -1,5 +1,5 @@
 conversion
-base64Decoded: aBase64String
+base64UrlDecoded: aBase64String
 
 	"According to https://tools.ietf.org/html/rfc7519#page-4 the encoding needs to be base64Url.
 	The padding can be stripped as it is not used for transport in JWT, so we need to pad it just in case"
diff --git a/source/JSONWebToken-Core.package/JWSSerializer.class/class/base64UrlEncoded..st b/source/JSONWebToken-Core.package/JWSSerializer.class/class/base64UrlEncoded..st
@@ -1,5 +1,5 @@
 conversion
-base64Encoded: aByteArray
+base64UrlEncoded: aByteArray
 
 	"According to https://tools.ietf.org/html/rfc7519#page-4 the encoding needs to be base64Url.
 	The padding is stripped as it is not used for transport in JWT"
diff --git a/source/JSONWebToken-Core.package/JsonWebAlgorithm.class/class/checkSignature.withKey..st b/source/JSONWebToken-Core.package/JsonWebAlgorithm.class/class/checkSignature.withKey..st
@@ -0,0 +1,8 @@
+sign
+checkSignature: token withKey: key
+	"keep this method backward compatible also accepting already splitted parts"
+	self 
+		checkSignatureOfParts: (token isString 
+			ifTrue: [ $. split: token ]
+			ifFalse: [ token ])
+		withKey: key
diff --git a/source/JSONWebToken-Core.package/JsonWebAlgorithm.class/class/checkSignatureOfParts.withKey..st b/source/JSONWebToken-Core.package/JsonWebAlgorithm.class/class/checkSignatureOfParts.withKey..st
@@ -0,0 +1,3 @@
+sign
+checkSignatureOfParts: parts withKey: key
+	self subclassResponsibility 
diff --git a/source/JSONWebToken-Core.package/JsonWebSignature.class/instance/base64UrlDecoded..st b/source/JSONWebToken-Core.package/JsonWebSignature.class/instance/base64UrlDecoded..st
@@ -1,4 +1,4 @@
 private
-base64Decoded: aBase64String
+base64UrlDecoded: aBase64String
 
 	^ Base64UrlEncoder new decode: aBase64String base64Padded
diff --git a/source/JSONWebToken-Core.package/JsonWebSignature.class/instance/checkSignature..st b/source/JSONWebToken-Core.package/JsonWebSignature.class/instance/checkSignature..st
@@ -1,5 +1,10 @@
 signature
-checkSignature: parts
-
+checkSignature: aString
+	| token |
+	token := (aString isString not) 
+		ifTrue: [ 
+			"this seems to be the old usage handing out the parts collection so resemble"
+			$. join: aString  ]
+		ifFalse: [ aString ].
 	
-	self protectedHeader algorithm checkSignature: parts withKey: key
+	self protectedHeader algorithm checkSignature: token withKey: key
diff --git a/source/JSONWebToken-OpenSSL.package/JWARSASHA256.class/class/checkSignature.withKey..st b/source/JSONWebToken-OpenSSL.package/JWARSASHA256.class/class/checkSignature.withKey..st
diff --git a/source/JSONWebToken-OpenSSL.package/JWARSASHA256.class/class/checkSignatureOfParts.withKey..st b/source/JSONWebToken-OpenSSL.package/JWARSASHA256.class/class/checkSignatureOfParts.withKey..st
@@ -0,0 +1,20 @@
+sign
+checkSignatureOfParts: parts withKey: key
+	| jwtHeaderAndPayload signatureByteArray publicKey |
+	jwtHeaderAndPayload := $.
+		join:
+			{parts first.
+			parts second}.
+	signatureByteArray := JWSSerializer base64UrlDecoded: parts third "base64Padded base64Decoded".
+	publicKey := (key includesSubstring: 'BEGIN RSA PUBLIC KEY')
+		ifTrue: [ LcEvpPublicKey setRSA:  (LcRSA fromRsaPublicKeyPemString: key) ]
+		ifFalse: [ LcEvpPublicKey fromPublicKeyPemString: key ].
+	jwtHeaderAndPayload pinInMemory.
+	signatureByteArray pinInMemory.
+	[ (publicKey
+		digestVerifyMessage: jwtHeaderAndPayload
+		with: signatureByteArray)
+		ifFalse: [ Error signal: 'signature does not match' ] ]
+		ensure: [ 
+			jwtHeaderAndPayload unpinInMemory.
+			signatureByteArray unpinInMemory  ]
diff --git a/source/JSONWebToken-OpenSSL.package/JWARSASHA256.class/class/signMessage.withKey..st b/source/JSONWebToken-OpenSSL.package/JWARSASHA256.class/class/signMessage.withKey..st
@@ -1,6 +1,8 @@
 sign
-signMessage: aString withKey: anObject
+signMessage: message withKey: anObject
 	| pkey sig |
 	pkey := LcEvpPublicKey setRSA: (LcRSA fromPemString: anObject).
-	sig := pkey digestSignMessage: aString.
+	message pinInMemory.
+	sig := [ pkey digestSignMessage: message ]
+		ensure: [ message unpinInMemory ].
 	^ sig

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+as yet unclassified`
	`2`	`+simpleTokenString`
	`3`	`+ ^ self simpleJsonWebSignature compactSerialized.`
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+sign`
	`2`	`+checkSignatureOfParts: parts withKey: key`
	`3`	`+`