From: Remi Tricot-Le Breton <rlebreton@haproxy.com>
Date: Tue, 20 Oct 2026 08:04:49 +0000 (+0200)
Subject: BUG/MINOR: jwe: only match the exact "ALL" word in jwt.decrypt_{alg,enc}_list
X-Git-Tag: v3.5-dev10~80
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=59366ef447aa73ed883d5b4aa66bfc4419412ad0;p=haproxy.git

BUG/MINOR: jwe: only match the exact "ALL" word in jwt.decrypt_{alg,enc}_list

The parsing of the special 'ALL' case in "jwt.decrypt_alg_list" and
"jwt.decrypt_enc_list" did not check the actual string length so a too
short string could be wrongly treated as 'ALL'.

This was introduced in 3.4 by commit f82a242c8 ("MINOR: jwe: Add option to
enable/disable algorithms or encryption algorithms for jwt_decrypt"), so
the fix must be backported to 3.4.
---

diff --git a/src/jwe.c b/src/jwe.c
index 0ab480683..e29ac8182 100644
--- a/src/jwe.c
+++ b/src/jwe.c
@@ -2274,7 +2274,7 @@ static int jwe_parse_global_alg_enc_list(char **args, int section_type, struct p
 
 		/* If "ALL" is used all previously disabled algo will be
 		 * reenabled */
-		if (strncmp(alg, "ALL", alg_end - alg) == 0) {
+		if (alg_end - alg == 3 && strncmp(alg, "ALL", alg_end - alg) == 0) {
 			set_all_alg_enc_flags(arr, ALG_ENC_ENABLED);
 		} else {
 			if (set_alg_enc_flag(arr, alg, alg_end-alg, value) != 0) {