cim/zitadel-oidc
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(deps): update go-jose to new updated repo due to migration (#630)

Browse source 
* updates go-jose to new updated repo due to migration

- updated from /square/go-jose to /go-jose/go-jose
- updates to v2.6.3
- addresses CVE-2016-9123 and CVE-2016-9121
- fixes tests that were adjusting for a 1s delay

* revert 299>300 in op_test.go
This commit is contained in:
Andrew 2024-08-27 05:58:50 -04:00 • committed by GitHub
parent e8769ce896
commit 2308e2f8be
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
32 changed files with 33 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

2
example/server/storage/storage.go
View file

@ -12,7 +12,7 @@ import (
"time" "time"
"github.com/google/uuid" "github.com/google/uuid"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"
"github.com/zitadel/oidc/v2/pkg/op" "github.com/zitadel/oidc/v2/pkg/op"

2
example/server/storage/storage_dynamic.go
View file

@ -4,7 +4,7 @@ import (
"context" "context"
"time" "time"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"
"github.com/zitadel/oidc/v2/pkg/op" "github.com/zitadel/oidc/v2/pkg/op"

2
go.mod
View file

@ -19,7 +19,7 @@ require (
go.opentelemetry.io/otel/trace v1.24.0 go.opentelemetry.io/otel/trace v1.24.0
golang.org/x/oauth2 v0.20.0 golang.org/x/oauth2 v0.20.0
golang.org/x/text v0.15.0 golang.org/x/text v0.15.0
gopkg.in/square/go-jose.v2 v2.6.0 gopkg.in/go-jose/go-jose.v2 v2.6.3
) )
require ( require (

4
go.sum
View file

@ -90,8 +90,8 @@ golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8T
google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM= google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI= gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI= gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

2
internal/testutil/token.go
View file

@ -9,7 +9,7 @@ import (
"time" "time"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
) )
// KeySet implements oidc.Keys // KeySet implements oidc.Keys

2
pkg/client/client.go
View file

@ -12,7 +12,7 @@ import (
"time" "time"
"golang.org/x/oauth2" "golang.org/x/oauth2"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/crypto" "github.com/zitadel/oidc/v2/pkg/crypto"
httphelper "github.com/zitadel/oidc/v2/pkg/http" httphelper "github.com/zitadel/oidc/v2/pkg/http"

2
pkg/client/profile/jwt_profile.go
View file

@ -5,7 +5,7 @@ import (
"time" "time"
"golang.org/x/oauth2" "golang.org/x/oauth2"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/client" "github.com/zitadel/oidc/v2/pkg/client"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"

2
pkg/client/rp/jwks.go
View file

@ -7,7 +7,7 @@ import (
"net/http" "net/http"
"sync" "sync"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
httphelper "github.com/zitadel/oidc/v2/pkg/http" httphelper "github.com/zitadel/oidc/v2/pkg/http"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"

2
pkg/client/rp/relying_party.go
View file

@ -12,7 +12,7 @@ import (
"github.com/google/uuid" "github.com/google/uuid"
"golang.org/x/oauth2" "golang.org/x/oauth2"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/client" "github.com/zitadel/oidc/v2/pkg/client"
httphelper "github.com/zitadel/oidc/v2/pkg/http" httphelper "github.com/zitadel/oidc/v2/pkg/http"

2
pkg/client/rp/verifier.go
View file

@ -4,7 +4,7 @@ import (
"context" "context"
"time" "time"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"
) )

2
pkg/client/rp/verifier_test.go
View file

@ -9,7 +9,7 @@ import (
"github.com/stretchr/testify/require" "github.com/stretchr/testify/require"
tu "github.com/zitadel/oidc/v2/internal/testutil" tu "github.com/zitadel/oidc/v2/internal/testutil"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
) )
func TestVerifyTokens(t *testing.T) { func TestVerifyTokens(t *testing.T) {

2
pkg/crypto/hash.go
View file

@ -8,7 +8,7 @@ import (
"fmt" "fmt"
"hash" "hash"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
) )
var ErrUnsupportedAlgorithm = errors.New("unsupported signing algorithm") var ErrUnsupportedAlgorithm = errors.New("unsupported signing algorithm")

2
pkg/crypto/sign.go
View file

@ -4,7 +4,7 @@ import (
"encoding/json" "encoding/json"
"errors" "errors"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
) )
func Sign(object any, signer jose.Signer) (string, error) { func Sign(object any, signer jose.Signer) (string, error) {

2
pkg/oidc/keyset.go
View file

@ -7,7 +7,7 @@ import (
"crypto/rsa" "crypto/rsa"
"errors" "errors"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
) )
const ( const (

2
pkg/oidc/keyset_test.go
View file

@ -7,7 +7,7 @@ import (
"reflect" "reflect"
"testing" "testing"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
) )
func TestFindKey(t *testing.T) { func TestFindKey(t *testing.T) {

2
pkg/oidc/token.go
View file

@ -6,7 +6,7 @@ import (
"time" "time"
"golang.org/x/oauth2" "golang.org/x/oauth2"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/muhlemmer/gu" "github.com/muhlemmer/gu"
"github.com/zitadel/oidc/v2/pkg/crypto" "github.com/zitadel/oidc/v2/pkg/crypto"

2
pkg/oidc/token_request.go
View file

@ -5,7 +5,7 @@ import (
"fmt" "fmt"
"time" "time"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
) )
const ( const (

2
pkg/oidc/token_test.go
View file

@ -6,7 +6,7 @@ import (
"github.com/stretchr/testify/assert" "github.com/stretchr/testify/assert"
"golang.org/x/text/language" "golang.org/x/text/language"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
) )
var ( var (

2
pkg/oidc/types.go
View file

@ -11,7 +11,7 @@ import (
"github.com/gorilla/schema" "github.com/gorilla/schema"
"github.com/muhlemmer/gu" "github.com/muhlemmer/gu"
"golang.org/x/text/language" "golang.org/x/text/language"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
) )
type Audience []string type Audience []string

2
pkg/oidc/verifier.go
View file

@ -10,7 +10,7 @@ import (
"strings" "strings"
"time" "time"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
str "github.com/zitadel/oidc/v2/pkg/strings" str "github.com/zitadel/oidc/v2/pkg/strings"
) )

2
pkg/op/discovery.go
View file

@ -4,7 +4,7 @@ import (
"context" "context"
"net/http" "net/http"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
httphelper "github.com/zitadel/oidc/v2/pkg/http" httphelper "github.com/zitadel/oidc/v2/pkg/http"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"

2
pkg/op/discovery_test.go
View file

@ -9,7 +9,7 @@ import (
"github.com/golang/mock/gomock" "github.com/golang/mock/gomock"
"github.com/stretchr/testify/assert" "github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require" "github.com/stretchr/testify/require"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"
"github.com/zitadel/oidc/v2/pkg/op" "github.com/zitadel/oidc/v2/pkg/op"

2
pkg/op/keys.go
View file

@ -4,7 +4,7 @@ import (
"context" "context"
"net/http" "net/http"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
httphelper "github.com/zitadel/oidc/v2/pkg/http" httphelper "github.com/zitadel/oidc/v2/pkg/http"
) )

2
pkg/op/keys_test.go
View file

@ -9,7 +9,7 @@ import (
"github.com/golang/mock/gomock" "github.com/golang/mock/gomock"
"github.com/stretchr/testify/assert" "github.com/stretchr/testify/assert"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"
"github.com/zitadel/oidc/v2/pkg/op" "github.com/zitadel/oidc/v2/pkg/op"

2
pkg/op/mock/authorizer.mock.impl.go
View file

@ -6,7 +6,7 @@ import (
"github.com/golang/mock/gomock" "github.com/golang/mock/gomock"
"github.com/gorilla/schema" "github.com/gorilla/schema"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"
"github.com/zitadel/oidc/v2/pkg/op" "github.com/zitadel/oidc/v2/pkg/op"

2
pkg/op/mock/discovery.mock.go
View file

@ -9,7 +9,7 @@ import (
reflect "reflect" reflect "reflect"
gomock "github.com/golang/mock/gomock" gomock "github.com/golang/mock/gomock"
jose "gopkg.in/square/go-jose.v2" jose "gopkg.in/go-jose/go-jose.v2"
) )
// MockDiscoverStorage is a mock of DiscoverStorage interface. // MockDiscoverStorage is a mock of DiscoverStorage interface.

2
pkg/op/mock/signer.mock.go
View file

@ -8,7 +8,7 @@ import (
reflect "reflect" reflect "reflect"
gomock "github.com/golang/mock/gomock" gomock "github.com/golang/mock/gomock"
jose "gopkg.in/square/go-jose.v2" jose "gopkg.in/go-jose/go-jose.v2"
) )
// MockSigningKey is a mock of SigningKey interface. // MockSigningKey is a mock of SigningKey interface.

2
pkg/op/mock/storage.mock.go
View file

@ -12,7 +12,7 @@ import (
gomock "github.com/golang/mock/gomock" gomock "github.com/golang/mock/gomock"
oidc "github.com/zitadel/oidc/v2/pkg/oidc" oidc "github.com/zitadel/oidc/v2/pkg/oidc"
op "github.com/zitadel/oidc/v2/pkg/op" op "github.com/zitadel/oidc/v2/pkg/op"
jose "gopkg.in/square/go-jose.v2" jose "gopkg.in/go-jose/go-jose.v2"
) )
// MockStorage is a mock of Storage interface. // MockStorage is a mock of Storage interface.

2
pkg/op/op.go
View file

@ -12,7 +12,7 @@ import (
"go.opentelemetry.io/otel" "go.opentelemetry.io/otel"
"go.opentelemetry.io/otel/trace" "go.opentelemetry.io/otel/trace"
"golang.org/x/text/language" "golang.org/x/text/language"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
httphelper "github.com/zitadel/oidc/v2/pkg/http" httphelper "github.com/zitadel/oidc/v2/pkg/http"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"

2
pkg/op/signer.go
View file

@ -3,7 +3,7 @@ package op
import ( import (
"errors" "errors"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
) )
var ErrSignerCreationFailed = errors.New("signer creation failed") var ErrSignerCreationFailed = errors.New("signer creation failed")

2
pkg/op/storage.go
View file

@ -5,7 +5,7 @@ import (
"errors" "errors"
"time" "time"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"
) )

2
pkg/op/verifier_jwt_profile.go
View file

@ -6,7 +6,7 @@ import (
"fmt" "fmt"
"time" "time"
"gopkg.in/square/go-jose.v2" "gopkg.in/go-jose/go-jose.v2"
"github.com/zitadel/oidc/v2/pkg/oidc" "github.com/zitadel/oidc/v2/pkg/oidc"
) )