Fix for not honoring ValidationTimePayload's signedDate #231
Conversation
|
Thanks! Can you add a test to ensure that the original bug doesn't get reintroduced? |
|
We would need a correctly signed token with a |
|
May I please ask you again to accept the PR? |
Sources/JWTKit/X5C/EmptyPolicy.swift
Outdated
| // | ||
| // AlwaysMeetsPolicy.swift | ||
| // jwt-kit | ||
| // | ||
| // Created by Bastian Rössler on 02.07.25. | ||
| // | ||
|
|
Sources/JWTKit/X5C/EmptyPolicy.swift
Outdated
|
|
||
| @inlinable | ||
| public func chainMeetsPolicyRequirements(chain: UnverifiedCertificateChain) -> PolicyEvaluationResult { | ||
| return .meetsPolicy |
There was a problem hiding this comment.
| return .meetsPolicy | |
| .meetsPolicy |
Sources/JWTKit/X5C/EmptyPolicy.swift
Outdated
| import SwiftASN1 | ||
|
|
||
| /// This Policy acts as a placeholder. Its result is always positive. | ||
| @available(macOS 10.15, iOS 13, watchOS 6, tvOS 13, macCatalyst 13, visionOS 1.0, *) |
There was a problem hiding this comment.
This isn't needed as JWTKit already requires higher platform versions
|
@ptoffy I have just made the requested changes. Would be great if you could accept the PR now :-) |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #231 +/- ##
==========================================
+ Coverage 83.52% 83.55% +0.03%
==========================================
Files 56 57 +1
Lines 1493 1496 +3
==========================================
+ Hits 1247 1250 +3
Misses 246 246
🚀 New features to boost your workflow:
|
|
The compiler error was caused by an update to a dependency library. I just fixed it. About the |
3 participants
Bug Description
When using the
X5CVerifierto verify a Payload that conforms toValidationTimePayloadthesignedDateof theValidationTimePayloadwould be used to initialize aRFC5280Policy. Unfortunately the default@PolicyBuilderthat is used in the respectiveverifyJWSfunction also contained aRFC5280Policy, which was always initialized to the current date.As both policies need to be met in order for the verification to succeed, the
ValidationTimePayload'ssignedDatewas effectively ignored. Other negative side effects could be described but I'll keep it short here.Proposed Solution
As
@resultBuilders can not be optional in Swift, a way was needed to provide a default verification policy that would not affect the policy that would be created further down the code depending on the payload's conformance toValidationTimePayload. I have therefore created a dummyEmptyPolicy, which is always met.The solution does not have any negative side effects, as a
RFC5280Policyis added further down the code in any case. Only this time, it is either initialized with thesignedDateof aValidationTimePayloador the current date.