BUG/MINOR: jwe: only accept exact "alg" and "enc" names in JWE tokens

The 'alg' and 'enc' parser does not check the value length so a too
short value would still be seen as the full one ("A1" instead of
"A128CBC-HS256" for instance).

This was introduced in 3.4 by commit 416b87d5d ("MINOR: jwe: Add new
jwt_decrypt_secret converter"), so the fix must be backported to 3.4.

diff --git a/reg-tests/jwt/jwt_decrypt.vtc b/reg-tests/jwt/jwt_decrypt.vtc
index e7802d632ffdf55a862dea2fefec53bcaa25add6..f22e5a6c9919555cd15665426e696c782ea0e014 100644 (file)
--- a/reg-tests/jwt/jwt_decrypt.vtc
+++ b/reg-tests/jwt/jwt_decrypt.vtc
@@ -67,6 +67,11 @@ haproxy h1 -conf {
         use_backend jwk if { path_beg /jwk }
         default_backend dflt
 
+    # frontend used only to check that jwt_decrypt_secret does not accept
+    # truncated alg/enc names
+    frontend algenc_fe
+        bind "fd@${algencfe}"
+        http-request return status 200 hdr x-res "<%[req.hdr(x-tok),jwt_decrypt_secret(\"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8=\")]>"
 
     backend secret_based_alg
 
@@ -323,3 +328,24 @@ client c10 -connect ${h1_mainfe_sock} {
     expect resp.http.x-decrypted == "Random test message for ECDH-ES+A256KW encrypted tokens"
 
 } -run
+
+# Check that truncated alg/enc names are not accepted
+client c11 -connect ${h1_algencfe_sock} {
+    # "alg":"dir", "enc":"A128CBC-HS256"
+    txreq -hdr "x-tok: eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0..IzbGkbjTnQ839myrKPqMSQ.-XHg1kkrtAMxn8RC3hBDFw.a0Z1SGUgL06ah5-dKFOFRA"
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-res == "<hello>"
+
+    # "alg":"d"
+    txreq -hdr "x-tok: eyJhbGciOiJkIiwiZW5jIjoiQTEyOENCQy1IUzI1NiJ9..ASTxW817QnC0JsyBUQLrew.kn-7BbRJ2nJtIA-C72snQQ.XrzQz7Ovvge_tCy72HJSkg"
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-res == "<>"
+
+    # "enc":"A1"
+    txreq -hdr "x-tok: eyJhbGciOiJkaXIiLCJlbmMiOiJBMSJ9..ZekK-JnLX3_C5uH0YVh7HQ.i9_XPL7jzAat-TgvEU9Csg.dRT33If2uzWh7mgvWYk6wA"
+    rxresp
+    expect resp.status == 200
+    expect resp.http.x-res == "<>"
+} -run

diff --git a/src/jwe.c b/src/jwe.c
index b16ba4133e74f2d91afbcde83e83514ca055b191..146b64738702693c7685419bdf516a3a5deb687e 100644 (file)
--- a/src/jwe.c
+++ b/src/jwe.c
@@ -142,7 +142,8 @@ static inline int parse_alg_enc(struct buffer *buf, struct alg_enc *array)
        int val = -1;
 
        while (item->name) {
-               if (strncmp(item->name, b_orig(buf), (int)b_data(buf)) == 0) {
+               if (strlen(item->name) == b_data(buf) &&
+                   memcmp(item->name, b_orig(buf), b_data(buf)) == 0) {
                        if (item->enabled == ALG_ENC_DISABLED)
                                return -1;
                        val = item->value;