NPE in KeyUseAndOpsConsistency.areConsistent() with unknown KeyUse value

[Serge Hauser]

According to the spec other values than “sig” and “enc” may be used. However using an unkown value results in an NPE. I think we should return true in that case.

‌

Can be reproduced with JWKSet.parse() with the following keyset:

{
"keys": [
  {
    "alg": "RS256",
    "kty": "RSA",
    "use": "unknown",
    "x5c": [
      "MIIC+DCCAeCgAwIBAgIJBIGjYW6hFpn2MA0GCSqGSIb3DQEBBQUAMCMxITAfBgNVBAMTGGN1c3RvbWVyLWRlbW9zLmF1dGgwLmNvbTAeFw0xNjExMjIyMjIyMDVaFw0zMDA4MDEyMjIyMDVaMCMxITAfBgNVBAMTGGN1c3RvbWVyLWRlbW9zLmF1dGgwLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMnjZc5bm/eGIHq09N9HKHahM7Y31P0ul+A2wwP4lSpIwFrWHzxw88/7Dwk9QMc+orGXX95R6av4GF+Es/nG3uK45ooMVMa/hYCh0Mtx3gnSuoTavQEkLzCvSwTqVwzZ+5noukWVqJuMKNwjL77GNcPLY7Xy2/skMCT5bR8UoWaufooQvYq6SyPcRAU4BtdquZRiBT4U5f+4pwNTxSvey7ki50yc1tG49Per/0zA4O6Tlpv8x7Red6m1bCNHt7+Z5nSl3RX/QYyAEUX1a28VcYmR41Osy+o2OUCXYdUAphDaHo4/8rbKTJhlu8jEcc1KoMXAKjgaVZtG/v5ltx6AXY0CAwEAAaMvMC0wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUQxFG602h1cG+pnyvJoy9pGJJoCswDQYJKoZIhvcNAQEFBQADggEBAGvtCbzGNBUJPLICth3mLsX0Z4z8T8iu4tyoiuAshP/Ry/ZBnFnXmhD8vwgMZ2lTgUWwlrvlgN+fAtYKnwFO2G3BOCFw96Nm8So9sjTda9CCZ3dhoH57F/hVMBB0K6xhklAc0b5ZxUpCIN92v/w+xZoz1XQBHe8ZbRHaP1HpRM4M7DJk2G5cgUCyu3UBvYS41sHvzrxQ3z7vIePRA4WF4bEkfX12gvny0RsPkrbVMXX1Rj9t6V7QXrbPYBAO+43JvDGYawxYVvLhz+BJ45x50GFQmHszfY3BR9TPK8xmMmQwtIvLu1PMttNCs7niCYkSiUv2sc2mlq1i3IashGkkgmo="
    ]
  }]
}

‌

‌

[Serge Hauser]

https://bitbucket.org/connect2id/nimbus-jose-jwt/pull-requests/83

[Vladimir Dzhuvinov]

Thanks for discovering this and posting here about the problem. I'll check the PR.

[Vladimir Dzhuvinov]

FIX: #436 NPE in KeyUseAndOpsConsistency.areConsistent() with unknown KeyUse value

→ <<cset 4515d920d8ea>>

[Vladimir Dzhuvinov]

Merged in master (pull request #83)

FIX: #436 NPE in KeyUseAndOpsConsistency.areConsistent() with unknown KeyUse value

Approved-by: Vladimir Dzhuvinov

→ <<cset 55b407f11b7b>>

[Vladimir Dzhuvinov]

The fix just went to Maven Central as

version 9.11.1 (2021-07-13)
    * Fixes an NPE in KeyUseAndOpsConsistency.areConsistent when the KeyUse
      is a non-standard value other than "sig" and "enc" (iss #436).

Thanks!