Patched code sample

import jwt
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey

class PatchedJWTDecoder:
    def __init__(self):
        self.supported_algorithms = {'RS256', 'HS256'}
        self.hmac_algs = {'HS256', 'HS384', 'HS512'}

    def _validate_key_for_algorithm(self, alg, key):
        """
        This function represents the logic added to fix the vulnerability.
        It explicitly checks if an asymmetric key is being used for a
        symmetric algorithm.
        """
        if alg in self.hmac_algs:
            if isinstance(key, (RSAPublicKey)):
                raise jwt.InvalidKeyError(
                    f"The specified key is an asymmetric key and cannot be "
                    f"used for the symmetric algorithm {alg}."
                )

    def decode(self, token, key):
        # In a real scenario, the token's header would be read first.
        # We simulate this by assuming the attacker chose 'HS256'.
        algorithm_from_token = 'HS256'

        if algorithm_from_token not in self.supported_algorithms:
            raise jwt.InvalidAlgorithmError("Algorithm not supported")

        # This is the new, crucial validation step.
        self._validate_key_for_algorithm(algorithm_from_token, key)

        # If the validation passes, the library would proceed with verification.
        # Since our key is invalid, an exception should have been raised.
        print("VULNERABLE: Key was accepted. Verification would proceed.")


# --- Setup: Attacker and Verifier context ---

# 1. A legitimate server's public key (for 'RS256' tokens).
#    This key is public and available to the attacker.
private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
public_key = private_key.public_key()

# 2. The verifier is configured to accept both RS256 and HS256 tokens.
decoder = PatchedJWTDecoder()

# 3. Attacker crafts a fake token with 'alg': 'HS256' and signs it
#    using the server's public key as the HMAC secret.
#    (We don't need the actual token, just the key and chosen algorithm).
maliciously_used_key = public_key
fake_token = "dummy_token_string"

# --- Demonstration of the Fix ---

print("Attempting to verify a token using the public key as an HMAC secret...")

try:
    decoder.decode(fake_token, key=maliciously_used_key)
except jwt.InvalidKeyError as e:
    print(f"\nFIXED: The operation was blocked correctly.")
    print(f"Error: {e}")
except Exception as e:
    print(f"\nAn unexpected error occurred: {e}")