You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@oltu.apache.org by "Antonio Sanso (JIRA)" <ji...@apache.org> on 2016/07/27 11:16:20 UTC
[jira] [Updated] (OLTU-200) Wrong regex in TokenReader
[ https://issues.apache.org/jira/browse/OLTU-200?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Antonio Sanso updated OLTU-200:
-------------------------------
Description:
The regex in TokenReader [0] doesn't comply with the JWS spec.
The spec [1] says:
{code}
BASE64URL(UTF8(JWS Protected Header)) || '.' ||
BASE64URL(JWS Payload) || '.' ||
BASE64URL(JWS Signature)
{code}
while the impl regex is
{code}
private final Pattern base64urlTokenPattern = Pattern.compile("([a-zA-Z0-9/+=]+)\\.([a-zA-Z0-9/+=]+)\\.(.+)");
{code}
it should be rather
{code}
private final base64urlTokenPattern = Pattern.compile("([a-zA-Z0-9-_=]+)\\.([a-zA-Z0-9-_=]+)\\.([a-zA-Z0-9-_=]+)
{code}
[0] https://github.com/apache/oltu/blob/trunk/commons/encodedtoken/src/main/java/org/apache/oltu/commons/encodedtoken/TokenReader.java#L30
[1] https://tools.ietf.org/html/rfc7515
was:
The regex in TokenReader [0] doesn't comply with the JWS spec.
The spec [1] says:
{code}
BASE64URL(UTF8(JWS Protected Header)) || '.' ||
BASE64URL(JWS Payload) || '.' ||
BASE64URL(JWS Signature)
{code}
while the impl regex is
{code}
private final Pattern base64urlTokenPattern = Pattern.compile("([a-zA-Z0-9/+=]+)\\.([a-zA-Z0-9/+=]+)\\.(.+)");
{code}
it should be rather
{code}
private final Pattern.compile("([a-zA-Z0-9-_=]+)\\.([a-zA-Z0-9-_=]+)\\.([a-zA-Z0-9-_=]+)
{code}
[0] https://github.com/apache/oltu/blob/trunk/commons/encodedtoken/src/main/java/org/apache/oltu/commons/encodedtoken/TokenReader.java#L30
[1] https://tools.ietf.org/html/rfc7515
> Wrong regex in TokenReader
> --------------------------
>
> Key: OLTU-200
> URL: https://issues.apache.org/jira/browse/OLTU-200
> Project: Apache Oltu
> Issue Type: Bug
> Reporter: Antonio Sanso
> Assignee: Antonio Sanso
>
> The regex in TokenReader [0] doesn't comply with the JWS spec.
> The spec [1] says:
> {code}
> BASE64URL(UTF8(JWS Protected Header)) || '.' ||
> BASE64URL(JWS Payload) || '.' ||
> BASE64URL(JWS Signature)
> {code}
> while the impl regex is
> {code}
> private final Pattern base64urlTokenPattern = Pattern.compile("([a-zA-Z0-9/+=]+)\\.([a-zA-Z0-9/+=]+)\\.(.+)");
> {code}
> it should be rather
> {code}
> private final base64urlTokenPattern = Pattern.compile("([a-zA-Z0-9-_=]+)\\.([a-zA-Z0-9-_=]+)\\.([a-zA-Z0-9-_=]+)
> {code}
> [0] https://github.com/apache/oltu/blob/trunk/commons/encodedtoken/src/main/java/org/apache/oltu/commons/encodedtoken/TokenReader.java#L30
> [1] https://tools.ietf.org/html/rfc7515
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)