gschjetne / cljwt Goto Github PK

This problem will be solved when the advice from #1 is applied

Cljwt is unaffected by the critical vulnerability reported by Auth0 since it is only capable of none and HS256 algorithms, no asymmetric ones. This is a reminder to require the DECODE function to be supplied an algorithm (or more, provided it's not a vulnerable combination).

As can be seen from:

CL-USER> (cljwt:decode (cljwt:issue () :algorithm :none))
; Evaluation aborted on #<CL-BASE64:BAD-BASE64-CHARACTER
{10129F4883}>.

The code that re-injects padding into the base64 strings is broken.
Since the fix only needs four cases, and the correct logic is fiddly,
I picked a case statement.

Please consider adding cljwt to quicklisp.