From b8150f25b88a410a573fc68b259b223ce194a36b Mon Sep 17 00:00:00 2001 From: David Christofas Date: Thu, 12 Aug 2021 13:57:58 +0200 Subject: [PATCH] switch jwt library The old library github.com/dgrijalva/jwt-go is now unmaintained and was replaced by the community maintained fork github.com/golang-jwt/jwt --- changelog/unreleased/switch-jwt-lib.md | 5 +++ go.mod | 4 +-- go.sum | 6 ++-- proxy/pkg/middleware/oidc_auth.go | 46 ++++++++++++-------------- 4 files changed, 31 insertions(+), 30 deletions(-) create mode 100644 changelog/unreleased/switch-jwt-lib.md diff --git a/changelog/unreleased/switch-jwt-lib.md b/changelog/unreleased/switch-jwt-lib.md new file mode 100644 index 0000000000..a6b7fee269 --- /dev/null +++ b/changelog/unreleased/switch-jwt-lib.md @@ -0,0 +1,5 @@ +Enhancement: Replace unmaintained jwt library + +The old library [github.com/dgrijalva/jwt-go](https://github.com/dgrijalva/jwt-go) is unmaintained and was replaced by the community maintained fork [github.com/golang-jwt/jwt](https://github.com/golang-jwt/jwt). + +https://github.com/owncloud/ocis/pull/2386 diff --git a/go.mod b/go.mod index a4fd85a036..64f19033ef 100644 --- a/go.mod +++ b/go.mod @@ -26,7 +26,6 @@ require ( github.com/cs3org/go-cs3apis v0.0.0-20210802070913-970eec344e59 github.com/cs3org/reva v1.11.1-0.20210809134415-3fe79c870fb5 github.com/cznic/b v0.0.0-20181122101859-a26611c4d92d // indirect - github.com/dgrijalva/jwt-go v3.2.0+incompatible github.com/disintegration/imaging v1.6.2 github.com/glauth/glauth v1.1.3-0.20210729125545-b9aecdfcac31 github.com/go-chi/chi v4.1.2+incompatible @@ -34,6 +33,7 @@ require ( github.com/go-logr/logr v0.4.0 github.com/go-ozzo/ozzo-validation/v4 v4.2.1 github.com/gofrs/uuid v3.3.0+incompatible + github.com/golang-jwt/jwt/v4 v4.0.0 github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 github.com/golang/protobuf v1.5.2 github.com/gopherjs/gopherjs v0.0.0-20200217142428-fce0ec30dd00 // indirect @@ -42,7 +42,7 @@ require ( github.com/iancoleman/strcase v0.1.3 github.com/jmhodges/levigo v1.0.0 // indirect github.com/justinas/alice v1.2.0 - github.com/libregraph/lico v0.34.1-0.20210803054646-b584e0372224 // indirect + github.com/libregraph/lico v0.34.1-0.20210803054646-b584e0372224 github.com/mennanov/fieldmask-utils v0.3.3 github.com/micro/cli/v2 v2.1.2 github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 diff --git a/go.sum b/go.sum index b15eaead3d..0e78060541 100644 --- a/go.sum +++ b/go.sum @@ -365,7 +365,6 @@ github.com/glycerine/goconvey v0.0.0-20190410193231-58a59202ab31 h1:gclg6gY70GLy github.com/glycerine/goconvey v0.0.0-20190410193231-58a59202ab31/go.mod h1:Ogl1Tioa0aV7gstGFO7KhffUsb9M4ydbEbbxpcEDc24= github.com/go-acme/lego/v3 v3.4.0/go.mod h1:xYbLDuxq3Hy4bMUT1t9JIuz6GWIWb3m5X+TeTHYaT7M= github.com/go-asn1-ber/asn1-ber v1.3.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= -github.com/go-asn1-ber/asn1-ber v1.4.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= github.com/go-asn1-ber/asn1-ber v1.5.1 h1:pDbRAunXzIUXfx4CB2QJFv5IuPiuoW+sWvr/Us009o8= github.com/go-asn1-ber/asn1-ber v1.5.1/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0= github.com/go-chi/chi v4.1.2+incompatible h1:fGFk2Gmi/YKXk0OmGfBh0WgmN3XB8lVnEyNz34tQRec= @@ -454,6 +453,8 @@ github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69 github.com/goji/httpauth v0.0.0-20160601135302-2da839ab0f4d/go.mod h1:nnjvkQ9ptGaCkuDUx6wNykzzlUixGxvkme+H/lnzb+A= github.com/golang-jwt/jwt v3.2.2+incompatible h1:IfV12K8xAKAnZqdXVzCZ+TOjboZ2keLg81eXfW3O+oY= github.com/golang-jwt/jwt v3.2.2+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I= +github.com/golang-jwt/jwt/v4 v4.0.0 h1:RAqyYixv1p7uEnocuy8P1nru5wprCh/MH2BIlW5z5/o= +github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg= github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 h1:DACJavvAHhabrF08vX0COfcOBJRhZ8lUbR+ZWIs0Y5g= github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k= github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q= @@ -955,7 +956,6 @@ github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsT github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ= github.com/prometheus/procfs v0.0.5/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ= github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A= -github.com/prometheus/procfs v0.0.10/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A= github.com/prometheus/procfs v0.0.11/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU= @@ -1755,8 +1755,6 @@ sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc= sourcegraph.com/sourcegraph/appdash v0.0.0-20190731080439-ebfcffb1b5c0/go.mod h1:hI742Nqp5OhwiqlzhgfbWU4mW4yO10fP+LoT9WOswdU= sourcegraph.com/sourcegraph/go-diff v0.5.0/go.mod h1:kuch7UrkMzY0X+p9CRK03kfuPQ2zzQcaEFbx8wA8rck= sourcegraph.com/sqs/pbtypes v0.0.0-20180604144634-d3ebe8f20ae4/go.mod h1:ketZ/q3QxT9HOBeFhu6RdvsftgpsbFHBF5Cas6cDKZ0= -stash.kopano.io/kc/konnect v0.34.0 h1:aKjZpLu8fvrrqVvNU9b2vKZOn8lUusXLoycLWgMi3o0= -stash.kopano.io/kc/konnect v0.34.0/go.mod h1:GV6AxroXyHte83EsiJXA5ZygzofQ48zXCJ3qX9bK1JY= stash.kopano.io/kgol/kcc-go/v5 v5.0.1 h1:urR9hOR6TnTKjGkzZKac/a9cA8ws1WecWLTgiYubLQw= stash.kopano.io/kgol/kcc-go/v5 v5.0.1/go.mod h1:0ZmjWapy3zp+TAjZI6iCrcfh+BthZbB2WM1VfhDgNB4= stash.kopano.io/kgol/ksurveyclient-go v0.6.0/go.mod h1:LJMDQBROS2oXxBN04eSI6j1KhgWlqMFd8xKjXV4Irtw= diff --git a/proxy/pkg/middleware/oidc_auth.go b/proxy/pkg/middleware/oidc_auth.go index f225dd96b5..81f05acfd4 100644 --- a/proxy/pkg/middleware/oidc_auth.go +++ b/proxy/pkg/middleware/oidc_auth.go @@ -2,17 +2,17 @@ package middleware import ( "context" - "encoding/json" "net/http" "strings" "time" - "github.com/dgrijalva/jwt-go" + "github.com/golang-jwt/jwt/v4" gOidc "github.com/coreos/go-oidc" "github.com/owncloud/ocis/ocis-pkg/log" "github.com/owncloud/ocis/ocis-pkg/oidc" "github.com/owncloud/ocis/ocis-pkg/sync" + "github.com/owncloud/ocis/proxy/pkg/config" "golang.org/x/oauth2" ) @@ -27,12 +27,13 @@ func OIDCAuth(optionSetters ...Option) func(next http.Handler) http.Handler { tokenCache := sync.NewCache(options.UserinfoCacheSize) h := oidcAuth{ - logger: options.Logger, - providerFunc: options.OIDCProviderFunc, - httpClient: options.HTTPClient, - oidcIss: options.OIDCIss, - tokenCache: &tokenCache, - tokenCacheTTL: options.UserinfoCacheTTL, + logger: options.Logger, + providerFunc: options.OIDCProviderFunc, + httpClient: options.HTTPClient, + oidcIss: options.OIDCIss, + TokenManagerConfig: options.TokenManagerConfig, + tokenCache: &tokenCache, + tokenCacheTTL: options.UserinfoCacheTTL, } return func(next http.Handler) http.Handler { @@ -69,13 +70,14 @@ func OIDCAuth(optionSetters ...Option) func(next http.Handler) http.Handler { } type oidcAuth struct { - logger log.Logger - provider OIDCProvider - providerFunc func() (OIDCProvider, error) - httpClient *http.Client - oidcIss string - tokenCache *sync.Cache - tokenCacheTTL time.Duration + logger log.Logger + provider OIDCProvider + providerFunc func() (OIDCProvider, error) + httpClient *http.Client + oidcIss string + tokenCache *sync.Cache + tokenCacheTTL time.Duration + TokenManagerConfig config.TokenManager } func (m oidcAuth) getClaims(token string, req *http.Request) (claims map[string]interface{}, status int) { @@ -124,19 +126,15 @@ func (m oidcAuth) getClaims(token string, req *http.Request) (claims map[string] func (m oidcAuth) extractExpiration(token string) time.Time { defaultExpiration := time.Now().Add(m.tokenCacheTTL) - s := strings.SplitN(token, ".", 4) - if len(s) != 3 { - return defaultExpiration - } - - b, err := jwt.DecodeSegment(s[1]) + t, err := jwt.Parse(token, func(t *jwt.Token) (interface{}, error) { + return []byte(m.TokenManagerConfig.JWTSecret), nil + }) if err != nil { return defaultExpiration } - at := &jwt.StandardClaims{} - err = json.Unmarshal(b, at) - if err != nil || at.ExpiresAt == 0 { + at, ok := t.Claims.(jwt.StandardClaims) + if !ok || at.ExpiresAt == 0 { return defaultExpiration }