Patched code sample

import json
from authlib.jws import JsonWebSignature
from authlib.common.errors import AuthlibBaseError

def demonstrate_cve_fix():
    """
    This function demonstrates the fix for a vulnerability where JWS verification
    incorrectly accepts tokens with unknown critical header parameters ('crit').

    The fix involves explicitly checking the 'crit' header and rejecting the token
    if it contains any parameters not understood by the verifier, as required by
    RFC 7515.
    """

    # A verifier's list of header parameters that it understands and processes.
    # According to RFC 7515, 'alg' is implicitly understood and not listed here.
    # For this demo, we'll assume the verifier only understands 'kid'.
    SUPPORTED_CRITICAL_HEADERS = {'kid'}

    def fixed_verify_jws(token_string, public_key):
        """
        A verifier implementation that correctly handles the 'crit' header.
        """
        jws = JsonWebSignature()
        try:
            data = jws.deserialize_compact(token_string, public_key)
            header = data['header']
        except AuthlibBaseError as e:
            # Handle standard JWS processing errors (e.g., bad signature)
            raise ValueError(f"JWS deserialization failed: {e}")

        # --- START OF THE VULNERABILITY FIX ---
        # RFC 7515 Section 4.1.11: The 'crit' header lists headers that
        # MUST be understood and processed by the implementation.
        if 'crit' in header:
            if not isinstance(header['crit'], list):
                raise ValueError("'crit' header parameter must be a list.")

            critical_params = set(header['crit'])
            
            # Check for any critical headers that are not in our supported list.
            unsupported_params = critical_params - SUPPORTED_CRITICAL_HEADERS
            
            if unsupported_params:
                # If any unsupported critical headers are found, the token
                # MUST be rejected. This is the core of the fix.
                raise ValueError(
                    f"Unsupported critical header(s) found: {list(unsupported_params)}"
                )
        # --- END OF THE VULNERABILITY FIX ---

        # If we reach here, the token is valid according to the fixed logic.
        return json.loads(data['payload'])

    # 1. Setup: A secret key for HS256 algorithm
    secret_key = b'a-secret-key-that-is-sufficiently-long-for-hs256'
    payload = b'{"user": "alice", "scope": "read"}'

    # 2. Attacker's goal: Craft a token with an unknown critical header.
    # An attacker adds a custom header 'bork' and lists it in 'crit'.
    # A vulnerable verifier would ignore 'bork' and accept the token.
    # A correct, fixed verifier MUST reject it because 'bork' is not understood.
    malicious_protected_header = {
        'alg': 'HS256',
        'crit': ['bork'],  # Declaring 'bork' as critical.
        'bork': 'some_malicious_value'
    }
    
    jws = JsonWebSignature()
    malicious_token = jws.serialize_compact(
        malicious_protected_header, payload, secret_key
    )

    print("--- Demonstrating the Fix ---")
    print(f"Attempting to verify a token with an unknown critical header 'bork'.")
    print(f"Malicious Token: {malicious_token.decode()}\n")

    # 3. Verification with the fixed logic
    try:
        # The vulnerable implementation would have successfully returned the payload.
        # The fixed implementation will raise a ValueError.
        fixed_verify_jws(malicious_token, secret_key)
        print("RESULT: [VULNERABLE] Verification SUCCEEDED. The fix is not effective.")
    except ValueError as e:
        print(f"RESULT: [FIXED] Verification FAILED as expected.")
        print(f"Reason: {e}")

if __name__ == '__main__':
    demonstrate_cve_fix()