Julien Cretel
ce56909505
jws: improve fix for CVE-2025-22868
...
The fix for CVE-2025-22868 relies on strings.Count, which isn't ideal
because it precludes failing fast when the token contains an unexpected
number of periods. Moreover, Verify still allocates more than necessary.
Eschew strings.Count in favor of strings.Cut. Some benchmark results:
goos: darwin
goarch: amd64
pkg: golang.org/x/oauth2/jws
cpu: Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz
│ old │ new │
│ sec/op │ sec/op vs base │
Verify/full_of_periods-8 24862.50n ± 1% 57.87n ± 0% -99.77% (p=0.000 n=20)
Verify/two_trailing_periods-8 3.485m ± 1% 3.445m ± 1% -1.13% (p=0.003 n=20)
geomean 294.3µ 14.12µ -95.20%
│ old │ new │
│ B/op │ B/op vs base │
Verify/full_of_periods-8 16.00 ± 0% 16.00 ± 0% ~ (p=1.000 n=20) ¹
Verify/two_trailing_periods-8 2.001Mi ± 0% 1.001Mi ± 0% -49.98% (p=0.000 n=20)
geomean 5.658Ki 4.002Ki -29.27%
¹ all samples are equal
│ old │ new │
│ allocs/op │ allocs/op vs base │
Verify/full_of_periods-8 1.000 ± 0% 1.000 ± 0% ~ (p=1.000 n=20) ¹
Verify/two_trailing_periods-8 12.000 ± 0% 9.000 ± 0% -25.00% (p=0.000 n=20)
geomean 3.464 3.000 -13.40%
¹ all samples are equal
Also, remove all remaining calls to strings.Split.
Updates golang/go#71490
Change-Id: Icac3c7a81562161ab6533d892ba19247d6d5b943
GitHub-Last-Rev: 3a82900f747798f5f36065126385880277c0fce7
GitHub-Pull-Request: golang/oauth2#774
Reviewed-on: https://go-review.googlesource.com/c/oauth2/+/655455
Commit-Queue: Neal Patel <nealpatel@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Neal Patel <nealpatel@google.com>
Auto-Submit: Neal Patel <nealpatel@google.com>
2025-03-13 08:12:56 -07:00
Jaana Burcu Dogan
e839600e66
oauth2, jws, internal: more style fixes for bad test messages
...
Change-Id: Id2805fd77fb11d975414eb66689efab284a18805
Reviewed-on: https://go-review.googlesource.com/27911
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-08-26 21:49:23 +00:00
Jeff Craig
8434495902
jws: Fix typo in jws_test
...
Test is currently failing due to a missed colon during cleanup.
Change-Id: I8cef4b679b2d981ad159441bffac67b7b23862aa
Reviewed-on: https://go-review.googlesource.com/22742
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-05-03 22:27:16 +00:00
Jeff Craig
14446d3f8b
jws: add RS256 Verification for JWS
...
Provides helper method for verifying a signed JWT against a provided
public key.
Change-Id: I498ecfce07862c372fd5f81c1fcdc09692ed0f5c
Reviewed-on: https://go-review.googlesource.com/21762
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-05-03 22:07:24 +00:00
