fix: reject public JWK container HMAC keys

Author: jpadilla

jwt/algorithms.py

@@ -367,15 +367,49 @@ def prepare_key(self, key: str | bytes) -> bytes:
         # should be loaded via PyJWK / from_jwk rather than fed as raw JSON
         # bytes (whose contents are not the secret material).
         try:
-            jwk_obj = json.loads(key_bytes)
+            jwk_obj = json.loads(key_bytes, parse_int=lambda _: 0)
         except RecursionError:
             try:
                 decoded_key = key_bytes.decode(
                     json.detect_encoding(key_bytes), errors="surrogatepass"
                 )
             except UnicodeError:
                 decoded_key = ""
-            if decoded_key.lstrip().startswith("{"):
+            stripped_key = decoded_key.lstrip("\ufeff \t\r\n")
+            has_jwk_member = False
+            index = 0
+            while index < len(decoded_key):
+                if decoded_key[index] != '"':
+                    index += 1
+                    continue
+                end = index + 1
+                while end < len(decoded_key):
+                    if decoded_key[end] == "\\":
+                        end += 2
+                    elif decoded_key[end] == '"':
+                        break
+                    else:
+                        end += 1
+                if end >= len(decoded_key):
+                    break
+                next_index = end + 1
+                while next_index < len(decoded_key) and decoded_key[
+                    next_index
+                ] in " \t\r\n":
+                    next_index += 1
+                if next_index < len(decoded_key) and decoded_key[next_index] == ":":
+                    try:
+                        has_jwk_member = json.loads(
+                            decoded_key[index : end + 1]
+                        ) == "kty"
+                    except ValueError:
+                        pass
+                    if has_jwk_member:
+                        break
+                index = end + 1
+            if stripped_key.startswith("{") or (
+                stripped_key.startswith("[") and has_jwk_member
+            ):
                 raise InvalidKeyError(
                     "The specified key looks like a JWK and should not be "
                     "used directly as an HMAC secret. Load it via "
@@ -384,7 +418,18 @@ def prepare_key(self, key: str | bytes) -> bytes:
             jwk_obj = None
         except ValueError:
             jwk_obj = None
-        if isinstance(jwk_obj, dict) and "kty" in jwk_obj:
+        contains_jwk_member = False
+        objects_to_check = [jwk_obj]
+        while objects_to_check:
+            obj = objects_to_check.pop()
+            if isinstance(obj, dict):
+                if "kty" in obj:
+                    contains_jwk_member = True
+                    break
+                objects_to_check.extend(obj.values())
+            elif isinstance(obj, list):
+                objects_to_check.extend(obj)
+        if contains_jwk_member:
             raise InvalidKeyError(
                 "The specified key looks like a JWK and should not be "
                 "used directly as an HMAC secret. Load it via "

tests/test_algorithms.py

@@ -200,6 +200,68 @@ def test_hmac_prepare_key_rejects_jwk_json(self, jwk_file: str) -> None:
             with pytest.raises(InvalidKeyError, match="looks like a JWK"):
                 algo.prepare_key(keyfile.read())
 
+    @pytest.mark.parametrize(
+        "container", ("jwks", "array", "nested-array", "bom-jwks")
+    )
+    def test_hmac_prepare_key_rejects_public_jwk_containers(
+        self, container: str
+    ) -> None:
+        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
+
+        with open(key_path("jwk_rsa_pub.json")) as keyfile:
+            public_jwk = json.load(keyfile)
+
+        if container == "jwks":
+            key: Union[str, bytes] = json.dumps({"keys": [public_jwk]})
+        elif container == "array":
+            key = json.dumps([public_jwk])
+        elif container == "nested-array":
+            key = json.dumps([[public_jwk]])
+        else:
+            key = b"\xef\xbb\xbf" + json.dumps(
+                {"keys": [public_jwk]}
+            ).encode()
+
+        with pytest.raises(InvalidKeyError, match="looks like a JWK"):
+            algo.prepare_key(key)
+
+    def test_hmac_prepare_key_rejects_deep_public_jwk_array(self) -> None:
+        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
+        depth = 20000
+        key = b"[" * depth + b'{"kty":"RSA"}' + b"]" * depth
+
+        with pytest.raises(InvalidKeyError, match="looks like a JWK"):
+            algo.prepare_key(key)
+
+    def test_hmac_prepare_key_rejects_deep_public_jwk_array_with_escaped_kty(
+        self,
+    ) -> None:
+        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
+        depth = 20000
+        key = b"[" * depth + b'{"\\u006bty":"RSA"}' + b"]" * depth
+
+        with pytest.raises(InvalidKeyError, match="looks like a JWK"):
+            algo.prepare_key(key)
+
+    def test_hmac_prepare_key_accepts_deep_array_secret_with_kty_string(
+        self,
+    ) -> None:
+        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
+        depth = 20000
+        key = b'["kty",' + b"[" * depth + b"0" + b"]" * depth + b"]"
+
+        assert algo.prepare_key(key) == key
+
+    def test_hmac_prepare_key_rejects_jwks_with_oversized_integer(self) -> None:
+        algo = HMACAlgorithm(HMACAlgorithm.SHA256)
+        with open(key_path("jwk_rsa_pub.json")) as keyfile:
+            public_jwk = json.load(keyfile)
+        key = json.dumps({"keys": [public_jwk], "extra": 0})
+        key = key.replace('"extra": 0', '"extra": ' + "1" * 5000)
+
+        with pytest.raises(InvalidKeyError, match="looks like a JWK"):
+            algo.prepare_key(key)
+
     @pytest.mark.parametrize(
         "encoding",
         [