{"action":"created","issue":{"url":"https://api.github.com/repos/jwtk/jjwt/issues/285","repository_url":"https://api.github.com/repos/jwtk/jjwt","labels_url":"https://api.github.com/repos/jwtk/jjwt/issues/285/labels{/name}","comments_url":"https://api.github.com/repos/jwtk/jjwt/issues/285/comments","events_url":"https://api.github.com/repos/jwtk/jjwt/issues/285/events","html_url":"https://github.com/jwtk/jjwt/issues/285","id":276629837,"number":285,"title":"Jwts.parser().parseClaimsJws(badString) throws ArrayIndexOutOfBoundsException","user":{"login":"ingebrigt","id":437092,"avatar_url":"https://avatars1.githubusercontent.com/u/437092?v=4","gravatar_id":"","url":"https://api.github.com/users/ingebrigt","html_url":"https://github.com/ingebrigt","followers_url":"https://api.github.com/users/ingebrigt/followers","following_url":"https://api.github.com/users/ingebrigt/following{/other_user}","gists_url":"https://api.github.com/users/ingebrigt/gists{/gist_id}","starred_url":"https://api.github.com/users/ingebrigt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ingebrigt/subscriptions","organizations_url":"https://api.github.com/users/ingebrigt/orgs","repos_url":"https://api.github.com/users/ingebrigt/repos","events_url":"https://api.github.com/users/ingebrigt/events{/privacy}","received_events_url":"https://api.github.com/users/ingebrigt/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-11-24T14:19:15Z","updated_at":"2018-03-11T20:45:00Z","closed_at":null,"author_association":"NONE","body":"Hi !\r\n\r\nI validate JWT's using: https://github.com/jwtk/jjwt/blob/master/src/main/java/io/jsonwebtoken/JwtParser.java#L396\r\n\r\nWhen I tamper with my input string, JwtParser.parseClaimsJws(String var1) throws an ArrayIndexOutOfBoundException:\r\n\r\n> java.lang.ArrayIndexOutOfBoundsException: 65433\r\n> \tat javax.xml.bind.DatatypeConverterImpl._parseBase64Binary(DatatypeConverterImpl.java:705)\r\n> \tat javax.xml.bind.DatatypeConverterImpl.parseBase64Binary(DatatypeConverterImpl.java:434)\r\n> \tat javax.xml.bind.DatatypeConverter.parseBase64Binary(DatatypeConverter.java:342)\r\n> \tat io.jsonwebtoken.impl.Base64Codec.decode(Base64Codec.java:26)\r\n> \tat io.jsonwebtoken.impl.Base64UrlCodec.decode(Base64UrlCodec.java:78)\r\n> \tat io.jsonwebtoken.impl.crypto.DefaultJwtSignatureValidator.isValid(DefaultJwtSignatureValidator.java:45)\r\n> \tat io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:351)\r\n> \tat io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:481)\r\n> \tat io.jsonwebtoken.impl.DefaultJwtParser.parseClaimsJws(DefaultJwtParser.java:541)\r\n\r\nThe error can easily be reproduced by inverting the bits in a random charachter in the JWT I use as input.\r\n\r\n(If you have trouble reproducing I can provide a test)\r\n\r\ncheers,\r\nIngebrigt\r\n"},"comment":{"url":"https://api.github.com/repos/jwtk/jjwt/issues/comments/372147586","html_url":"https://github.com/jwtk/jjwt/issues/285#issuecomment-372147586","issue_url":"https://api.github.com/repos/jwtk/jjwt/issues/285","id":372147586,"user":{"login":"ingebrigt","id":437092,"avatar_url":"https://avatars1.githubusercontent.com/u/437092?v=4","gravatar_id":"","url":"https://api.github.com/users/ingebrigt","html_url":"https://github.com/ingebrigt","followers_url":"https://api.github.com/users/ingebrigt/followers","following_url":"https://api.github.com/users/ingebrigt/following{/other_user}","gists_url":"https://api.github.com/users/ingebrigt/gists{/gist_id}","starred_url":"https://api.github.com/users/ingebrigt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ingebrigt/subscriptions","organizations_url":"https://api.github.com/users/ingebrigt/orgs","repos_url":"https://api.github.com/users/ingebrigt/repos","events_url":"https://api.github.com/users/ingebrigt/events{/privacy}","received_events_url":"https://api.github.com/users/ingebrigt/received_events","type":"User","site_admin":false},"created_at":"2018-03-11T20:45:00Z","updated_at":"2018-03-11T20:45:00Z","author_association":"NONE","body":"> I guess reason this https://bugs.openjdk.java.net/browse/JDK-8168456\r\n\r\nI agree.  \r\n\r\nFor my use I handled the problem by catching and handling ArrayIndexOutOfBoundsException. \r\nIf TokenSigningKey is not a valid base64 encoded String I don't verify the JWT. "}}
{"actor":{"display_login":"ingebrigt"}}