Skip to content

Commit f1352ee

Browse files
cdococdoco
committed
Fix #12 - Audience support string type .
1 parent 83b503c commit f1352ee

File tree

4 files changed

+74
-55
lines changed

4 files changed

+74
-55
lines changed

‎jwt.c

+43-52
Original file line numberDiff line numberDiff line change
@@ -295,22 +295,6 @@ long jwt_hash_str_find_long(zval *arr, char *key)
295295
return 0;
296296
}
297297

298-
/* hash find zend_array */
299-
zend_array *jwt_hash_str_find_ht(zval *arr, char *key)
300-
{
301-
zval *zv = zend_hash_str_find(Z_ARRVAL_P(arr), key, strlen(key));
302-
303-
if (zv != NULL) {
304-
if (Z_TYPE_P(zv) == IS_ARRAY) {
305-
return Z_ARRVAL_P(zv);
306-
} else {
307-
php_error_docref(NULL, E_WARNING, "%s type must be array", key);
308-
}
309-
}
310-
311-
return NULL;
312-
}
313-
314298
/* verify string claims */
315299
int jwt_verify_claims_str(zval *arr, char *key, char *str)
316300
{
@@ -362,57 +346,64 @@ int jwt_verify_body(char *body, zval *return_value)
362346
php_json_decode_ex(return_value, ZSTR_VAL(vs), ZSTR_LEN(vs), PHP_JSON_OBJECT_AS_ARRAY, 512);
363347
zend_string_free(vs);
364348

349+
#define FORMAT_CEX_TIME(t, cex) do { \
350+
struct tm *timeinfo; \
351+
char buf[128]; \
352+
timeinfo = localtime(&t); \
353+
strftime(buf, sizeof(buf), "Cannot handle token prior to %Y-%m-%d %H:%M:%S", timeinfo); \
354+
ce = cex; \
355+
err_msg = buf; \
356+
} while(0);
357+
358+
#define FORMAT_CEX_MSG(msg, cex) do { \
359+
ce = cex; \
360+
err_msg = msg; \
361+
} while(0);
362+
365363
/* Expiration */
366-
if (JWT_G(expiration) && (curr_time - JWT_G(leeway)) >= JWT_G(expiration)) {
367-
ce = jwt_expired_signature_cex;
368-
err_msg = "Expired token";
369-
}
364+
if (JWT_G(expiration) && (curr_time - JWT_G(leeway)) >= JWT_G(expiration))
365+
FORMAT_CEX_MSG("Expired token", jwt_expired_signature_cex);
370366

371367
/* not before */
372-
if (JWT_G(not_before) && JWT_G(not_before) > (curr_time + JWT_G(leeway))) {
373-
struct tm *timeinfo;
374-
char buf[128];
375-
376-
timeinfo = localtime(&JWT_G(not_before));
377-
strftime(buf, sizeof(buf), "Cannot handle token prior to %Y-%m-%d %H:%M:%S", timeinfo);
378-
ce = jwt_before_valid_cex;
379-
err_msg = buf;
380-
}
368+
if (JWT_G(not_before) && JWT_G(not_before) > (curr_time + JWT_G(leeway)))
369+
FORMAT_CEX_TIME(JWT_G(not_before), jwt_before_valid_cex);
381370

382371
/* iss */
383-
if (jwt_verify_claims_str(return_value, "iss", JWT_G(iss))) {
384-
ce = jwt_invalid_issuer_cex;
385-
err_msg = "Invalid Issuer";
386-
}
372+
if (jwt_verify_claims_str(return_value, "iss", JWT_G(iss)))
373+
FORMAT_CEX_MSG("Invalid Issuer", jwt_invalid_issuer_cex);
387374

388375
/* iat */
389376
if (JWT_G(iat) && JWT_G(iat) > (curr_time + JWT_G(leeway))) {
390-
struct tm *timeinfo;
391-
char buf[128];
392-
393-
timeinfo = localtime(&JWT_G(iat));
394-
strftime(buf, sizeof(buf), "Cannot handle token prior to %Y-%m-%d %H:%M:%S", timeinfo);
395-
ce = jwt_invalid_iat_cex;
396-
err_msg = buf;
377+
FORMAT_CEX_TIME(JWT_G(iat), jwt_invalid_iat_cex);
397378
}
398379

399380
/* jti */
400-
if (jwt_verify_claims_str(return_value, "jti", JWT_G(jti))) {
401-
ce = jwt_invalid_jti_cex;
402-
err_msg = "Invalid Jti";
403-
}
381+
if (jwt_verify_claims_str(return_value, "jti", JWT_G(jti)))
382+
FORMAT_CEX_MSG("Invalid Jti", jwt_invalid_jti_cex);
404383

405384
/* aud */
406-
if (jwt_array_equals(JWT_G(aud), jwt_hash_str_find_ht(return_value, "aud"))) {
407-
ce = jwt_invalid_aud_cex;
408-
err_msg = "Invalid Aud";
385+
size_t flag = 0;
386+
zval *zv_aud = zend_hash_str_find(Z_ARRVAL_P(return_value), "aud", strlen("aud"));
387+
388+
if (zv_aud && JWT_G(aud)) {
389+
switch(Z_TYPE_P(zv_aud)) {
390+
case IS_ARRAY:
391+
if (jwt_array_equals(Z_ARRVAL_P(JWT_G(aud)), Z_ARRVAL_P(zv_aud))) flag = 1;
392+
break;
393+
case IS_STRING:
394+
if (strcmp(Z_STRVAL_P(JWT_G(aud)), Z_STRVAL_P(zv_aud))) flag = 1;
395+
break;
396+
default:
397+
php_error_docref(NULL, E_WARNING, "Aud type must be string or array");
398+
break;
399+
}
400+
401+
if (flag) FORMAT_CEX_MSG("Invalid Aud", jwt_invalid_aud_cex);
409402
}
410403

411404
/* sub */
412-
if (jwt_verify_claims_str(return_value, "sub", JWT_G(sub))) {
413-
ce = jwt_invalid_sub_cex;
414-
err_msg = "Invalid Sub";
415-
}
405+
if (jwt_verify_claims_str(return_value, "sub", JWT_G(sub)))
406+
FORMAT_CEX_MSG("Invalid Sub", jwt_invalid_sub_cex);
416407

417408
if (err_msg) {
418409
zend_throw_exception(ce, err_msg, 0);
@@ -440,7 +431,7 @@ int jwt_parse_options(zval *options)
440431
JWT_G(leeway) = jwt_hash_str_find_long(options, "leeway");
441432
JWT_G(iss) = jwt_hash_str_find_str(options, "iss");
442433
JWT_G(jti) = jwt_hash_str_find_str(options, "jti");
443-
JWT_G(aud) = jwt_hash_str_find_ht(options, "aud");
434+
JWT_G(aud) = zend_hash_str_find(Z_ARRVAL_P(options), "aud", strlen("aud"));
444435
JWT_G(sub) = jwt_hash_str_find_str(options, "sub");
445436
}
446437
break;

‎jwt.php

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@
1515
],
1616
"sub" => "1234567890",
1717
"nbf" => time() + 1,
18-
"aud" => ['yy'],
18+
"aud" => 'yy',
1919
);
2020

2121
// default HS256 algorithm
2222
$token = JWT::encode($claims, $key);
2323

2424
echo $token . PHP_EOL;
25-
print_r(JWT::decode($token, $key, ["aud" => ['yy'], 'leeway' => 2, "iss" => "http://example.org"]));
25+
print_r(JWT::decode($token, $key, ["audx" => 'yy', 'leeway' => 2, "iss" => "http://example.org"]));

‎php_jwt.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ ZEND_BEGIN_MODULE_GLOBALS(jwt)
4646
char *iss;
4747
time_t iat;
4848
char *jti;
49-
zend_array *aud;
49+
zval *aud;
5050
char *sub;
5151
size_t leeway;
5252
char *algorithm;

‎tests/013.phpt

+28
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
--TEST--
2+
Check for jwt aud claim name (string type)
3+
--SKIPIF--
4+
<?php if (!extension_loaded("jwt")) print "skip"; ?>
5+
--FILE--
6+
<?php
7+
$hmackey = "example-hmac-key";
8+
$payload = ['data' => 'data', 'aud' => 'Young'];
9+
10+
$token = jwt_encode($payload, $hmackey, 'HS256');
11+
12+
try {
13+
$decoded_token = jwt_decode($token, $hmackey, ['aud' => 'Young', 'algorithm' => 'HS256']);
14+
echo "SUCCESS\n";
15+
} catch (InvalidAudException $e) {
16+
// Handle invalid token
17+
}
18+
19+
try {
20+
$decoded_token = jwt_decode($token, $hmackey, ['aud' => 'young', 'algorithm' => 'HS256']);
21+
} catch (InvalidAudException $e) {
22+
// Handle invalid token
23+
echo "FAIL\n";
24+
}
25+
?>
26+
--EXPECT--
27+
SUCCESS
28+
FAIL

0 commit comments

Comments
 (0)