parser.go

package jwt

import (
	"bytes"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"strings"
)

// ErrDuplicateKey is returned when a JSON object in the token contains duplicate keys.
var ErrDuplicateKey = errors.New("token contains duplicate keys")

type Parser struct {
	ValidMethods         []string // If populated, only these methods will be considered valid
	UseJSONNumber        bool     // Use JSON Number format in claims instead of float64
	SkipClaimsValidation bool     // Skip claims validation during token parsing
}

// Parse parses, validates, and returns a token.
// keyFunc will receive the parsed token and should return the key for validating.
// If everything is ok, err will be nil.
func (p *Parser) Parse(tokenString string, keyFunc Keyfunc) (*Token, error) {
	return p.ParseWithClaims(tokenString, MapClaims{}, keyFunc)
}

func (p *Parser) ParseWithClaims(tokenString string, claims Claims, keyFunc Keyfunc) (*Token, error) {
	token, parts, err := p.ParseUnverified(tokenString, claims)
	if err != nil {
		return token, err
	}

	// Verify signing method
	var sigVal error
	if err = token.Method.Verify(strings.Join(parts[0:2], "."), token.Signature, keyFunc); err != nil {
		sigVal = err
	}

	// Lookup signature error
	if sigVal != nil {
		return token, &ValidationError{Inner: sigVal, Errors: ValidationErrorSignatureInvalid}
	}

	// Validate Claims
	if !p.SkipClaimsValidation {
		if err := token.Claims.Valid(); err != nil {
			return token, &ValidationError{Inner: err, Errors: ValidationErrorClaimsInvalid}
		}
	}

	token.Valid = true
	return token, nil
}

// ParseUnverified parses the token but doesn't validate the signature. It's only
// useful if you know the signature is valid or if you've already verified it.
func (p *Parser) ParseUnverified(tokenString string, claims Claims) (token *Token, parts []string, err error) {
	parts = strings.Split(tokenString, ".")
	if len(parts) != 3 {
		return nil, parts, &ValidationError{Inner: fmt.Errorf("token contains an invalid number of segments"), Errors: ValidationErrorMalformed}
	}

	token = &Token{Raw: tokenString}

	// parse Header
	var headerBytes []byte
	if headerBytes, err = DecodeSegment(parts[0]); err != nil {
		if strings.HasPrefix(err.Error(), "illegal base64 data") {
			return token, parts, &ValidationError{Inner: err, Errors: ValidationErrorMalformed}
		}
		return token, parts, err
	}
	if err = checkDuplicateKeys(headerBytes); err != nil {
		return token, parts, &ValidationError{Inner: err, Errors: ValidationErrorMalformed}
	}
	if err = json.Unmarshal(headerBytes, &token.Header); err != nil {
		return token, parts, &ValidationError{Inner: err, Errors: ValidationErrorMalformed}
	}

	// parse Claims
	var claimsBytes []byte
	if claimsBytes, err = DecodeSegment(parts[1]); err != nil {
		if strings.HasPrefix(err.Error(), "illegal base64 data") {
			return token, parts, &ValidationError{Inner: err, Errors: ValidationErrorMalformed}
		}
		return token, parts, err
	}
	if err = checkDuplicateKeys(claimsBytes); err != nil {
		return token, parts, &ValidationError{Inner: err, Errors: ValidationErrorMalformed}
	}
	if err = json.Unmarshal(claimsBytes, claims); err != nil {
		return token, parts, &ValidationError{Inner: err, Errors: ValidationErrorMalformed}
	}

	token.Claims = claims

	return token, parts, nil
}

func checkDuplicateKeys(data []byte) error {
	dec := json.NewDecoder(bytes.NewReader(data))
	return checkDuplicates(dec)
}

func checkDuplicates(dec *json.Decoder) error {
	t, err := dec.Token()
	if err != nil {
		if err == io.EOF {
			return nil
		}
		return err
	}
	delim, ok := t.(json.Delim)
	if !ok {
		return nil
	}
	switch delim {
	case '{':
		keys := make(map[string]bool)
		for dec.More() {
			t, err := dec.Token()
			if err != nil {
				return err
			}
			key, ok := t.(string)
			if !ok {
				return fmt.Errorf("expected string key, got %T", t)
			}
			if keys[key] {
				return ErrDuplicateKey
			}
			keys[key] = true
			if err := checkDuplicates(dec); err != nil {
				return err
			}
		}
		// consume closing '}'
		if _, err := dec.Token(); err != nil {
			return err
		}
	case '[':
		for dec.More() {
			if err := checkDuplicates(dec); err != nil {
				return err
			}
		}
		// consume closing ']'
		if _, err := dec.Token(); err != nil {
			return err
		}
	}
	return nil
}