Panic seen when parsing invalid 'exp' claim attribute
Author: pkmachaniCreated Aug 20, 2021Updated Aug 20, 2021
in version 4.0.0 of library, I noticed in my tests there was panic seen when parsing the 'exp' claim attribute, it appears from code the validation of parsed value did not check for error and dereferenced causing it to panic.
claim values used for testing
{ "iss": "87190e4d-db7a", "sub": "714a4cfc-9ba7", "aud": "5GCORE", "scope": "somescope", "exp": "not/an/actual/date" }
algorithm: RS256
File time.go
// UnmarshalJSON implements the json package's Unmarshaler interface
func (t *Time) UnmarshalJSON(data []byte) error {
var value json.Number
err := json.Unmarshal(data, &value)
if err != nil {
return err
}
v, err := ParseTime(value)
*t = *v <== dereference causing panic
return err
}Panic:
/usr/lib/go/src/runtime/panic.go:679 +0x1b2 github.com/dgrijalva/jwt-go/v4.(*Time).UnmarshalJSON(0xc0001a5700, 0xc000160468, 0x14, 0x15, 0x7f6c4451afd8, 0xc0001a5700)
/root/go/pkg/mod/github.com/dgrijalva/jwt-go/[email protected]/time.go:70 +0xc4 encoding/json.(*decodeState).literalStore(0xc0002efb80, 0xc000160468, 0x14, 0x15, 0xc07c00, 0xc0001943a8, 0x196, 0x0, 0xbd, 0xc0002efba8)
/usr/lib/go/src/encoding/json/decode.go:918 +0x2b7b
Source: dgrijalva/jwt-go