sqlmapproject/sqlmap
1
0
Fork 0
mirror of https://github.com/sqlmapproject/sqlmap.git synced 2026-10-12 02:22:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Minor patch

Browse Source
This commit is contained in:
Miroslav Štampar
2026-08-04 22:46:04 +02:00
parent fca694c327
commit 96fec6864e
3 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_jwt.py
+7
View File
@@ -24,6 +24,7 @@ from lib.core.data import conf
from lib.core.enums import PLACE
from lib.utils.jwt import auditJWT
from lib.utils.jwt import crackHMAC
from lib.utils.jwt import encodeSegment
from lib.utils.jwt import findJWTs
from lib.utils.jwt import forgeJWT
from lib.utils.jwt import parseJWT
@@ -41,6 +42,12 @@ class JWTUtilsTest(unittest.TestCase):
for value in ("", "a.b", "a.b.c.d", "not.a.jwt", "eyJx.eyJx"):
self.assertIsNone(parseJWT(value))
def test_parse_rejects_non_string_alg(self):
# RFC 7515: "alg" MUST be a string; a crafted token with e.g. an integer "alg" must not parse
# (a permissive gate here would let a non-string "alg" reach auditJWT's alg.strip() and crash)
token = "%s.%s." % (encodeSegment({"alg": 123}), encodeSegment({}))
self.assertIsNone(parseJWT(token))
def test_forge_none_is_unsigned(self):
token = forgeJWT({"alg": "none"}, {"user": "admin"})
self.assertTrue(token.endswith("."))