Skip to content

Commit 0f9f656

Browse files
harryzcyGiteaBot
harryzcy
and
GiteaBot
authored
Bump github.com/golang-jwt/jwt to v5 (#25975)
Bumping `github.com/golang-jwt/jwt` from v4 to v5. `github.com/golang-jwt/jwt` v5 is bringing some breaking changes: - standard `Valid()` method on claims is removed. It's replaced by `ClaimsValidator` interface implementing `Validator()` method instead, which is called after standard validation. Gitea doesn't seem to be using this logic. - `jwt.Token` has a field `Valid`, so it's checked in `ParseToken` function in `services/auth/source/oauth2/token.go` --------- Co-authored-by: Giteabot <teabot@gitea.io>
1 parent 50e1469 commit 0f9f656

File tree

11 files changed

+32
-23
lines changed

11 files changed

+32
-23
lines changed

‎assets/go-licenses.json

+5
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/serv.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ import (
3030
"code.gitea.io/gitea/modules/setting"
3131
"code.gitea.io/gitea/services/lfs"
3232

33-
"github.com/golang-jwt/jwt/v4"
33+
"github.com/golang-jwt/jwt/v5"
3434
"github.com/kballard/go-shellquote"
3535
"github.com/urfave/cli"
3636
)

‎go.mod

+3-2
Original file line numberDiff line numberDiff line change
@@ -49,12 +49,12 @@ require (
4949
github.com/go-sql-driver/mysql v1.7.1
5050
github.com/go-swagger/go-swagger v0.30.5
5151
github.com/go-testfixtures/testfixtures/v3 v3.9.0
52-
github.com/go-webauthn/webauthn v0.8.4
52+
github.com/go-webauthn/webauthn v0.8.6
5353
github.com/gobwas/glob v0.2.3
5454
github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
5555
github.com/gogs/cron v0.0.0-20171120032916-9f6c956d3e14
5656
github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
57-
github.com/golang-jwt/jwt/v4 v4.5.0
57+
github.com/golang-jwt/jwt/v5 v5.0.0
5858
github.com/google/go-github/v53 v53.2.0
5959
github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8
6060
github.com/google/uuid v1.3.0
@@ -196,6 +196,7 @@ require (
196196
github.com/go-openapi/validate v0.22.1 // indirect
197197
github.com/go-webauthn/x v0.1.4 // indirect
198198
github.com/goccy/go-json v0.10.2 // indirect
199+
github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
199200
github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
200201
github.com/golang-sql/sqlexp v0.1.0 // indirect
201202
github.com/golang/geo v0.0.0-20230421003525-6adc56603217 // indirect

‎go.sum

+4-2
Original file line numberDiff line numberDiff line change
@@ -455,8 +455,8 @@ github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg78
455455
github.com/go-test/deep v1.0.7 h1:/VSMRlnY/JSyqxQUzQLKVMAskpY/NZKFA5j2P+0pP2M=
456456
github.com/go-testfixtures/testfixtures/v3 v3.9.0 h1:938g5V+GWLVejm3Hc+nWCuEXRlcglZDDlN/t1gWzcSY=
457457
github.com/go-testfixtures/testfixtures/v3 v3.9.0/go.mod h1:cdsKD2ApFBjdog9jRsz6EJqF+LClq/hrwE9K/1Dzo4s=
458-
github.com/go-webauthn/webauthn v0.8.4 h1:/emQ9b9Rj4flWO94Fo8KJeYvZ6VzPywXsmqyDA/WicY=
459-
github.com/go-webauthn/webauthn v0.8.4/go.mod h1:ZqEa9OnSCdQf6CJvTWTDCsUcPRi8F3h7XCIDINwbBgI=
458+
github.com/go-webauthn/webauthn v0.8.6 h1:bKMtL1qzd2WTFkf1mFTVbreYrwn7dsYmEPjTq6QN90E=
459+
github.com/go-webauthn/webauthn v0.8.6/go.mod h1:emwVLMCI5yx9evTTvr0r+aOZCdWJqMfbRhF0MufyUog=
460460
github.com/go-webauthn/x v0.1.4 h1:sGmIFhcY70l6k7JIDfnjVBiAAFEssga5lXIUXe0GtAs=
461461
github.com/go-webauthn/x v0.1.4/go.mod h1:75Ug0oK6KYpANh5hDOanfDI+dvPWHk788naJVG/37H8=
462462
github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
@@ -504,6 +504,8 @@ github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85/go.mod h1:fR6z
504504
github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
505505
github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
506506
github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
507+
github.com/golang-jwt/jwt/v5 v5.0.0 h1:1n1XNM9hk7O9mnQoNBGolZvzebBQ7p93ULHRc28XJUE=
508+
github.com/golang-jwt/jwt/v5 v5.0.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
507509
github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
508510
github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
509511
github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=

‎modules/generate/generate.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import (
1212

1313
"code.gitea.io/gitea/modules/util"
1414

15-
"github.com/golang-jwt/jwt/v4"
15+
"github.com/golang-jwt/jwt/v5"
1616
)
1717

1818
// NewInternalToken generate a new value intended to be used by INTERNAL_TOKEN.

‎routers/web/auth/oauth.go

+10-12
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ import (
3737
user_service "code.gitea.io/gitea/services/user"
3838

3939
"gitea.com/go-chi/binding"
40-
"github.com/golang-jwt/jwt/v4"
40+
"github.com/golang-jwt/jwt/v5"
4141
"github.com/markbates/goth"
4242
"github.com/markbates/goth/gothic"
4343
go_oauth2 "golang.org/x/oauth2"
@@ -342,17 +342,15 @@ func IntrospectOAuth(ctx *context.Context) {
342342
form := web.GetForm(ctx).(*forms.IntrospectTokenForm)
343343
token, err := oauth2.ParseToken(form.Token, oauth2.DefaultSigningKey)
344344
if err == nil {
345-
if token.Valid() == nil {
346-
grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)
347-
if err == nil && grant != nil {
348-
app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)
349-
if err == nil && app != nil {
350-
response.Active = true
351-
response.Scope = grant.Scope
352-
response.Issuer = setting.AppURL
353-
response.Audience = []string{app.ClientID}
354-
response.Subject = fmt.Sprint(grant.UserID)
355-
}
345+
grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)
346+
if err == nil && grant != nil {
347+
app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)
348+
if err == nil && app != nil {
349+
response.Active = true
350+
response.Scope = grant.Scope
351+
response.Issuer = setting.AppURL
352+
response.Audience = []string{app.ClientID}
353+
response.Subject = fmt.Sprint(grant.UserID)
356354
}
357355
}
358356
}

‎routers/web/auth/oauth_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import (
1313
"code.gitea.io/gitea/modules/setting"
1414
"code.gitea.io/gitea/services/auth/source/oauth2"
1515

16-
"github.com/golang-jwt/jwt/v4"
16+
"github.com/golang-jwt/jwt/v5"
1717
"github.com/stretchr/testify/assert"
1818
)
1919

‎services/auth/source/oauth2/jwtsigningkey.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ import (
2222
"code.gitea.io/gitea/modules/setting"
2323
"code.gitea.io/gitea/modules/util"
2424

25-
"github.com/golang-jwt/jwt/v4"
25+
"github.com/golang-jwt/jwt/v5"
2626
)
2727

2828
// ErrInvalidAlgorithmType represents an invalid algorithm error.

‎services/auth/source/oauth2/token.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ import (
99

1010
"code.gitea.io/gitea/modules/timeutil"
1111

12-
"github.com/golang-jwt/jwt/v4"
12+
"github.com/golang-jwt/jwt/v5"
1313
)
1414

1515
// ___________ __
@@ -50,6 +50,9 @@ func ParseToken(jwtToken string, signingKey JWTSigningKey) (*Token, error) {
5050
if err != nil {
5151
return nil, err
5252
}
53+
if !parsedToken.Valid {
54+
return nil, fmt.Errorf("invalid token")
55+
}
5356
var token *Token
5457
var ok bool
5558
if token, ok = parsedToken.Claims.(*Token); !ok || !parsedToken.Valid {

‎services/lfs/server.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ import (
3232
"code.gitea.io/gitea/modules/setting"
3333
"code.gitea.io/gitea/modules/storage"
3434

35-
"github.com/golang-jwt/jwt/v4"
35+
"github.com/golang-jwt/jwt/v5"
3636
"github.com/minio/sha256-simd"
3737
)
3838

‎services/packages/auth.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import (
1313
"code.gitea.io/gitea/modules/log"
1414
"code.gitea.io/gitea/modules/setting"
1515

16-
"github.com/golang-jwt/jwt/v4"
16+
"github.com/golang-jwt/jwt/v5"
1717
)
1818

1919
type packageClaims struct {

0 commit comments

Comments
 (0)