1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
# frozen_string_literal: true
RSpec.describe JWT::JWA::Hmac do
let(:instance) { described_class.new('HS256', OpenSSL::Digest::SHA256) }
let(:valid_signature) { [60, 56, 87, 72, 185, 194, 150, 13, 18, 148, 76, 245, 94, 91, 201, 64, 111, 91, 167, 156, 43, 148, 41, 113, 168, 156, 137, 12, 11, 31, 58, 97].pack('C*') }
let(:hmac_secret) { 'secret_key' }
describe '#sign' do
subject { instance.sign(data: 'test', signing_key: hmac_secret) }
context 'when signing with a key' do
it { is_expected.to eq(valid_signature) }
end
# Address OpenSSL 3.0 errors with empty hmac_secret - https://github.com/jwt/ruby-jwt/issues/526
context 'when nil hmac_secret is passed' do
let(:hmac_secret) { nil }
context 'when OpenSSL 3.0 raises a malloc failure' do
before do
allow(OpenSSL::HMAC).to receive(:digest).and_raise(OpenSSL::HMACError.new('EVP_PKEY_new_mac_key: malloc failure'))
end
it 'raises JWT::DecodeError' do
expect { subject }.to raise_error(JWT::DecodeError, 'OpenSSL 3.0 does not support nil or empty hmac_secret')
end
end
context 'when OpenSSL raises any other error' do
before do
allow(OpenSSL::HMAC).to receive(:digest).and_raise(OpenSSL::HMACError.new('Another Random Error'))
end
it 'raises the original error' do
expect { subject }.to raise_error(OpenSSL::HMACError, 'Another Random Error')
end
end
context 'when other versions of openssl do not raise an exception' do
let(:response) { Base64.decode64("Q7DO+ZJl+eNMEOqdNQGSbSezn1fG1nRWHYuiNueoGfs=\n") }
before do
allow(OpenSSL::HMAC).to receive(:digest).and_return(response)
end
it { is_expected.to eql(response) }
end
end
context 'when blank hmac_secret is passed' do
let(:hmac_secret) { '' }
context 'when OpenSSL 3.0 raises a malloc failure' do
before do
allow(OpenSSL::HMAC).to receive(:digest).and_raise(OpenSSL::HMACError.new('EVP_PKEY_new_mac_key: malloc failure'))
end
it 'raises JWT::DecodeError' do
expect { subject }.to raise_error(JWT::DecodeError, 'OpenSSL 3.0 does not support nil or empty hmac_secret')
end
end
context 'when OpenSSL raises any other error' do
before do
allow(OpenSSL::HMAC).to receive(:digest).and_raise(OpenSSL::HMACError.new('Another Random Error'))
end
it 'raises the original error' do
expect { subject }.to raise_error(OpenSSL::HMACError, 'Another Random Error')
end
end
context 'when other versions of openssl do not raise an exception' do
let(:response) { Base64.decode64("Q7DO+ZJl+eNMEOqdNQGSbSezn1fG1nRWHYuiNueoGfs=\n") }
before do
allow(OpenSSL::HMAC).to receive(:digest).and_return(response)
end
it { is_expected.to eql(response) }
end
end
context 'when hmac_secret is passed' do
let(:hmac_secret) { 'test' }
context 'when OpenSSL 3.0 raises a malloc failure' do
before do
allow(OpenSSL::HMAC).to receive(:digest).and_raise(OpenSSL::HMACError.new('EVP_PKEY_new_mac_key: malloc failure'))
end
it 'raises the original error' do
expect { subject }.to raise_error(OpenSSL::HMACError, 'EVP_PKEY_new_mac_key: malloc failure')
end
end
context 'when OpenSSL raises any other error' do
before do
allow(OpenSSL::HMAC).to receive(:digest).and_raise(OpenSSL::HMACError.new('Another Random Error'))
end
it 'raises the original error' do
expect { subject }.to raise_error(OpenSSL::HMACError, 'Another Random Error')
end
end
context 'when other versions of openssl do not raise an exception' do
let(:response) { Base64.decode64("iM0hCLU0fZc885zfkFPX3UJwSHbYyam9ji0WglnT3fc=\n") }
before do
allow(OpenSSL::HMAC).to receive(:digest).and_return(response)
end
it { is_expected.to eql(response) }
end
end
end
describe '#verify' do
subject { instance.verify(data: 'test', signature: signature, verification_key: hmac_secret) }
context 'when signature is valid' do
let(:signature) { valid_signature }
it { is_expected.to be(true) }
end
context 'when signature is invalid' do
let(:signature) { [60, 56, 87, 72, 185, 194].pack('C*') }
it { is_expected.to be(false) }
end
end
end
|
