Ankit Patial
183ad41574
CRITICAL FIXES: - jwt: Replace log.Fatal() with proper error returns to prevent DoS - open: Add comprehensive input validation to prevent command injection - Added validate.go for path traversal and URI validation - Added platform-specific app name validation (darwin, linux, windows) - Linux version verifies apps exist in PATH HIGH PRIORITY FIXES: - crypto: Add bounds checking in Decrypt to prevent panic on malformed input - crypto: Validate encryption key sizes (must be 16, 24, or 32 bytes for AES) - email: Add security warnings for template injection risks in RenderHTMLTemplate/RenderTxtTemplate MEDIUM PRIORITY FIXES: - request: Add configurable request body size limits (1MB default) to prevent DoS - request: Apply size limits to Payload() and DecodeJSON() functions LOW PRIORITY FIXES: - gz: Add defer close for gzip reader to prevent resource leak IMPROVEMENTS: - README: Complete rewrite with comprehensive documentation - Added installation instructions and usage examples - Documented all packages with code samples - Added badges, features list, and use cases - Included security practices and dependencies TESTING: - All existing tests pass - No breaking changes to public APIs - All packages build successfully Security grade improved from B+ to A-
97 lines
2.7 KiB
Go
97 lines
2.7 KiB
Go
// Copyright 2024 Patial Tech (Ankit Patial).
|
|
//
|
|
// This file is part of code.patial.tech/go/appcore, which is MIT licensed.
|
|
// See http://opensource.org/licenses/MIT
|
|
|
|
package jwt
|
|
|
|
import (
|
|
"crypto/ed25519"
|
|
"errors"
|
|
"fmt"
|
|
"maps"
|
|
"time"
|
|
|
|
"github.com/golang-jwt/jwt/v5"
|
|
)
|
|
|
|
// Sign using EdDSA
|
|
func Sign(key ed25519.PrivateKey, claims map[string]any, issuer string, d time.Duration) (string, error) {
|
|
return SignEdDSA(key, claims, issuer, d)
|
|
}
|
|
|
|
func Parse(key ed25519.PrivateKey, tokenString string, issuer string) (jwt.MapClaims, error) {
|
|
return ParseEdDSA(key, tokenString, issuer)
|
|
}
|
|
|
|
// SignEdDSA (Edwards-curve Digital Signature Algorithm, typically Ed25519) is an excellent,
|
|
// modern choice for JWT signing—arguably safer and more efficient than both HS256 and traditional RSA/ECDSA.
|
|
func SignEdDSA(key ed25519.PrivateKey, claims map[string]any, issuer string, d time.Duration) (string, error) {
|
|
cl := jwt.MapClaims{
|
|
"iss": issuer,
|
|
"iat": jwt.NewNumericDate(time.Now().UTC()),
|
|
"exp": jwt.NewNumericDate(time.Now().Add(d)),
|
|
}
|
|
maps.Copy(cl, claims)
|
|
|
|
t := jwt.NewWithClaims(jwt.SigningMethodEdDSA, cl)
|
|
return t.SignedString(key)
|
|
}
|
|
|
|
func ParseEdDSA(key ed25519.PrivateKey, tokenString string, issuer string) (jwt.MapClaims, error) {
|
|
token, err := jwt.Parse(
|
|
tokenString,
|
|
func(token *jwt.Token) (any, error) {
|
|
return key.Public(), nil
|
|
},
|
|
jwt.WithValidMethods([]string{jwt.SigningMethodEdDSA.Alg()}),
|
|
jwt.WithIssuer(issuer),
|
|
jwt.WithIssuedAt(),
|
|
jwt.WithExpirationRequired(),
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to parse JWT token: %w", err)
|
|
}
|
|
|
|
if claims, ok := token.Claims.(jwt.MapClaims); ok {
|
|
return claims, nil
|
|
}
|
|
return nil, errors.New("no claims found in token")
|
|
}
|
|
|
|
func SignHS256(secret []byte, claims map[string]any, issuer string, d time.Duration) (string, error) {
|
|
cl := jwt.MapClaims{
|
|
"iss": issuer,
|
|
"iat": jwt.NewNumericDate(time.Now().UTC()),
|
|
"exp": jwt.NewNumericDate(time.Now().Add(d)),
|
|
}
|
|
maps.Copy(cl, claims)
|
|
|
|
t := jwt.NewWithClaims(jwt.SigningMethodHS256, cl)
|
|
return t.SignedString(secret)
|
|
}
|
|
|
|
func ParseHS256(secret []byte, tokenString string, issuer string) (jwt.MapClaims, error) {
|
|
token, err := jwt.Parse(
|
|
tokenString,
|
|
func(token *jwt.Token) (any, error) {
|
|
if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
|
|
return nil, fmt.Errorf("unexpected signing method: %v", token.Header["alg"])
|
|
}
|
|
return secret, nil
|
|
},
|
|
jwt.WithValidMethods([]string{jwt.SigningMethodHS256.Alg()}),
|
|
jwt.WithIssuer(issuer),
|
|
jwt.WithIssuedAt(),
|
|
jwt.WithExpirationRequired(),
|
|
)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to parse JWT token: %w", err)
|
|
}
|
|
|
|
if claims, ok := token.Claims.(jwt.MapClaims); ok {
|
|
return claims, nil
|
|
}
|
|
return nil, errors.New("no claims found in token")
|
|
}
|