Skip to content

Commit bb95c10

Browse files
azurelinux-securityKanishk Bansal
azurelinux-security
and
Kanishk Bansal
authored
[AutoPR- Security] Patch influxdb for CVE-2025-47911, CVE-2025-30204 [MEDIUM] (#15900)
Co-authored-by: Kanishk Bansal <kanbansal@microsoft.com>
1 parent 36764db commit bb95c10

3 files changed

Lines changed: 431 additions & 1 deletion

File tree

‎SPECS/influxdb/CVE-2025-30204.patch‎

Lines changed: 325 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,325 @@
1+
From 2f0e9add62078527821828c76865661aa7718a84 Mon Sep 17 00:00:00 2001
2+
From: Michael Fridman <mfridman@buf.build>
3+
Date: Fri, 21 Mar 2025 16:42:51 -0400
4+
Subject: [PATCH] Backporting 0951d18 to v4
5+
6+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
7+
Upstream-reference: https://github.com/golang-jwt/jwt/commit/2f0e9add62078527821828c76865661aa7718a84.patch
8+
---
9+
vendor/github.com/form3tech-oss/jwt-go/jwt_test.go | 89 +++++++++++++++++++++
10+
vendor/github.com/form3tech-oss/jwt-go/parser.go | 36 ++++++++-
11+
vendor/github.com/golang-jwt/jwt/jwt_test.go | 89 +++++++++++++++++++++
12+
vendor/github.com/golang-jwt/jwt/parser.go | 36 ++++++++-
13+
4 files changed, 244 insertions(+), 6 deletions(-)
14+
create mode 100644 vendor/github.com/form3tech-oss/jwt-go/jwt_test.go
15+
create mode 100644 vendor/github.com/golang-jwt/jwt/jwt_test.go
16+
17+
diff --git a/vendor/github.com/form3tech-oss/jwt-go/jwt_test.go b/vendor/github.com/form3tech-oss/jwt-go/jwt_test.go
18+
new file mode 100644
19+
index 0000000..b01e899
20+
--- /dev/null
21+
+++ b/vendor/github.com/form3tech-oss/jwt-go/jwt_test.go
22+
@@ -0,0 +1,89 @@
23+
+package jwt
24+
+
25+
+import (
26+
+ "testing"
27+
+)
28+
+
29+
+func TestSplitToken(t *testing.T) {
30+
+ t.Parallel()
31+
+
32+
+ tests := []struct {
33+
+ name string
34+
+ input string
35+
+ expected []string
36+
+ isValid bool
37+
+ }{
38+
+ {
39+
+ name: "valid token with three parts",
40+
+ input: "header.claims.signature",
41+
+ expected: []string{"header", "claims", "signature"},
42+
+ isValid: true,
43+
+ },
44+
+ {
45+
+ name: "invalid token with two parts only",
46+
+ input: "header.claims",
47+
+ expected: nil,
48+
+ isValid: false,
49+
+ },
50+
+ {
51+
+ name: "invalid token with one part only",
52+
+ input: "header",
53+
+ expected: nil,
54+
+ isValid: false,
55+
+ },
56+
+ {
57+
+ name: "invalid token with extra delimiter",
58+
+ input: "header.claims.signature.extra",
59+
+ expected: nil,
60+
+ isValid: false,
61+
+ },
62+
+ {
63+
+ name: "invalid empty token",
64+
+ input: "",
65+
+ expected: nil,
66+
+ isValid: false,
67+
+ },
68+
+ {
69+
+ name: "valid token with empty parts",
70+
+ input: "..signature",
71+
+ expected: []string{"", "", "signature"},
72+
+ isValid: true,
73+
+ },
74+
+ {
75+
+ // We are just splitting the token into parts, so we don't care about the actual values.
76+
+ // It is up to the caller to validate the parts.
77+
+ name: "valid token with all parts empty",
78+
+ input: "..",
79+
+ expected: []string{"", "", ""},
80+
+ isValid: true,
81+
+ },
82+
+ {
83+
+ name: "invalid token with just delimiters and extra part",
84+
+ input: "...",
85+
+ expected: nil,
86+
+ isValid: false,
87+
+ },
88+
+ {
89+
+ name: "invalid token with many delimiters",
90+
+ input: "header.claims.signature..................",
91+
+ expected: nil,
92+
+ isValid: false,
93+
+ },
94+
+ }
95+
+
96+
+ for _, tt := range tests {
97+
+ t.Run(tt.name, func(t *testing.T) {
98+
+ parts, ok := splitToken(tt.input)
99+
+ if ok != tt.isValid {
100+
+ t.Errorf("expected %t, got %t", tt.isValid, ok)
101+
+ }
102+
+ if ok {
103+
+ for i, part := range tt.expected {
104+
+ if parts[i] != part {
105+
+ t.Errorf("expected %s, got %s", part, parts[i])
106+
+ }
107+
+ }
108+
+ }
109+
+ })
110+
+ }
111+
+}
112+
diff --git a/vendor/github.com/form3tech-oss/jwt-go/parser.go b/vendor/github.com/form3tech-oss/jwt-go/parser.go
113+
index d6901d9..fb39651 100644
114+
--- a/vendor/github.com/form3tech-oss/jwt-go/parser.go
115+
+++ b/vendor/github.com/form3tech-oss/jwt-go/parser.go
116+
@@ -7,6 +7,8 @@ import (
117+
"strings"
118+
)
119+
120+
+const tokenDelimiter = "."
121+
+
122+
type Parser struct {
123+
ValidMethods []string // If populated, only these methods will be considered valid
124+
UseJSONNumber bool // Use JSON Number format in JSON decoder
125+
@@ -94,9 +96,10 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
126+
// been checked previously in the stack) and you want to extract values from
127+
// it.
128+
func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Token, parts []string, err error) {
129+
- parts = strings.Split(tokenString, ".")
130+
- if len(parts) != 3 {
131+
- return nil, parts, NewValidationError("token contains an invalid number of segments", ValidationErrorMalformed)
132+
+ var ok bool
133+
+ parts, ok = splitToken(tokenString)
134+
+ if !ok {
135+
+ return nil, nil, NewValidationError("token contains an invalid number of segments", ValidationErrorMalformed)
136+
}
137+
138+
token = &Token{Raw: tokenString}
139+
@@ -146,3 +149,30 @@ func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Toke
140+
141+
return token, parts, nil
142+
}
143+
+
144+
+// splitToken splits a token string into three parts: header, claims, and signature. It will only
145+
+// return true if the token contains exactly two delimiters and three parts. In all other cases, it
146+
+// will return nil parts and false.
147+
+func splitToken(token string) ([]string, bool) {
148+
+ parts := make([]string, 3)
149+
+ header, remain, ok := strings.Cut(token, tokenDelimiter)
150+
+ if !ok {
151+
+ return nil, false
152+
+ }
153+
+ parts[0] = header
154+
+ claims, remain, ok := strings.Cut(remain, tokenDelimiter)
155+
+ if !ok {
156+
+ return nil, false
157+
+ }
158+
+ parts[1] = claims
159+
+ // One more cut to ensure the signature is the last part of the token and there are no more
160+
+ // delimiters. This avoids an issue where malicious input could contain additional delimiters
161+
+ // causing unecessary overhead parsing tokens.
162+
+ signature, _, unexpected := strings.Cut(remain, tokenDelimiter)
163+
+ if unexpected {
164+
+ return nil, false
165+
+ }
166+
+ parts[2] = signature
167+
+
168+
+ return parts, true
169+
+}
170+
diff --git a/vendor/github.com/golang-jwt/jwt/jwt_test.go b/vendor/github.com/golang-jwt/jwt/jwt_test.go
171+
new file mode 100644
172+
index 0000000..b01e899
173+
--- /dev/null
174+
+++ b/vendor/github.com/golang-jwt/jwt/jwt_test.go
175+
@@ -0,0 +1,89 @@
176+
+package jwt
177+
+
178+
+import (
179+
+ "testing"
180+
+)
181+
+
182+
+func TestSplitToken(t *testing.T) {
183+
+ t.Parallel()
184+
+
185+
+ tests := []struct {
186+
+ name string
187+
+ input string
188+
+ expected []string
189+
+ isValid bool
190+
+ }{
191+
+ {
192+
+ name: "valid token with three parts",
193+
+ input: "header.claims.signature",
194+
+ expected: []string{"header", "claims", "signature"},
195+
+ isValid: true,
196+
+ },
197+
+ {
198+
+ name: "invalid token with two parts only",
199+
+ input: "header.claims",
200+
+ expected: nil,
201+
+ isValid: false,
202+
+ },
203+
+ {
204+
+ name: "invalid token with one part only",
205+
+ input: "header",
206+
+ expected: nil,
207+
+ isValid: false,
208+
+ },
209+
+ {
210+
+ name: "invalid token with extra delimiter",
211+
+ input: "header.claims.signature.extra",
212+
+ expected: nil,
213+
+ isValid: false,
214+
+ },
215+
+ {
216+
+ name: "invalid empty token",
217+
+ input: "",
218+
+ expected: nil,
219+
+ isValid: false,
220+
+ },
221+
+ {
222+
+ name: "valid token with empty parts",
223+
+ input: "..signature",
224+
+ expected: []string{"", "", "signature"},
225+
+ isValid: true,
226+
+ },
227+
+ {
228+
+ // We are just splitting the token into parts, so we don't care about the actual values.
229+
+ // It is up to the caller to validate the parts.
230+
+ name: "valid token with all parts empty",
231+
+ input: "..",
232+
+ expected: []string{"", "", ""},
233+
+ isValid: true,
234+
+ },
235+
+ {
236+
+ name: "invalid token with just delimiters and extra part",
237+
+ input: "...",
238+
+ expected: nil,
239+
+ isValid: false,
240+
+ },
241+
+ {
242+
+ name: "invalid token with many delimiters",
243+
+ input: "header.claims.signature..................",
244+
+ expected: nil,
245+
+ isValid: false,
246+
+ },
247+
+ }
248+
+
249+
+ for _, tt := range tests {
250+
+ t.Run(tt.name, func(t *testing.T) {
251+
+ parts, ok := splitToken(tt.input)
252+
+ if ok != tt.isValid {
253+
+ t.Errorf("expected %t, got %t", tt.isValid, ok)
254+
+ }
255+
+ if ok {
256+
+ for i, part := range tt.expected {
257+
+ if parts[i] != part {
258+
+ t.Errorf("expected %s, got %s", part, parts[i])
259+
+ }
260+
+ }
261+
+ }
262+
+ })
263+
+ }
264+
+}
265+
diff --git a/vendor/github.com/golang-jwt/jwt/parser.go b/vendor/github.com/golang-jwt/jwt/parser.go
266+
index d6901d9..fb39651 100644
267+
--- a/vendor/github.com/golang-jwt/jwt/parser.go
268+
+++ b/vendor/github.com/golang-jwt/jwt/parser.go
269+
@@ -7,6 +7,8 @@ import (
270+
"strings"
271+
)
272+
273+
+const tokenDelimiter = "."
274+
+
275+
type Parser struct {
276+
ValidMethods []string // If populated, only these methods will be considered valid
277+
UseJSONNumber bool // Use JSON Number format in JSON decoder
278+
@@ -94,9 +96,10 @@ func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyf
279+
// been checked previously in the stack) and you want to extract values from
280+
// it.
281+
func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Token, parts []string, err error) {
282+
- parts = strings.Split(tokenString, ".")
283+
- if len(parts) != 3 {
284+
- return nil, parts, NewValidationError("token contains an invalid number of segments", ValidationErrorMalformed)
285+
+ var ok bool
286+
+ parts, ok = splitToken(tokenString)
287+
+ if !ok {
288+
+ return nil, nil, NewValidationError("token contains an invalid number of segments", ValidationErrorMalformed)
289+
}
290+
291+
token = &Token{Raw: tokenString}
292+
@@ -146,3 +149,30 @@ func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Toke
293+
294+
return token, parts, nil
295+
}
296+
+
297+
+// splitToken splits a token string into three parts: header, claims, and signature. It will only
298+
+// return true if the token contains exactly two delimiters and three parts. In all other cases, it
299+
+// will return nil parts and false.
300+
+func splitToken(token string) ([]string, bool) {
301+
+ parts := make([]string, 3)
302+
+ header, remain, ok := strings.Cut(token, tokenDelimiter)
303+
+ if !ok {
304+
+ return nil, false
305+
+ }
306+
+ parts[0] = header
307+
+ claims, remain, ok := strings.Cut(remain, tokenDelimiter)
308+
+ if !ok {
309+
+ return nil, false
310+
+ }
311+
+ parts[1] = claims
312+
+ // One more cut to ensure the signature is the last part of the token and there are no more
313+
+ // delimiters. This avoids an issue where malicious input could contain additional delimiters
314+
+ // causing unecessary overhead parsing tokens.
315+
+ signature, _, unexpected := strings.Cut(remain, tokenDelimiter)
316+
+ if unexpected {
317+
+ return nil, false
318+
+ }
319+
+ parts[2] = signature
320+
+
321+
+ return parts, true
322+
+}
323+
--
324+
2.45.4
325+

0 commit comments

Comments
 (0)