From 62a0b21d2718f7f8bea84aa71fb24b9971c3a8e8 Mon Sep 17 00:00:00 2001 From: Jake Dallimore Date: Thu, 10 Oct 2024 12:24:17 +0800 Subject: [PATCH] MDL-83423 mod_lti: fix JWK decoding when multiple keys missing alg Related to MDL-77077, but was a case missed there. Now, any unusable keys (i.e. can't be used during the JWT decode), are dropped from the keyset if they don't have the 'alg' prop, preventing a 'missing alg' exception during keyset parsing. Since these cannot be used during decode, these aren't needed anyway. --- mod/lti/locallib.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mod/lti/locallib.php b/mod/lti/locallib.php index cf874402768..60fbf2022ad 100644 --- a/mod/lti/locallib.php +++ b/mod/lti/locallib.php @@ -1323,7 +1323,6 @@ function lti_verify_with_keyset($jwtparam, $keyseturl, $clientid) { throw new moodle_exception('errornocachedkeysetfound', 'mod_lti'); } $keysetarr = json_decode($keyset, true); - // JWK::parseKeySet uses RS256 algorithm by default. $keys = JWK::parseKeySet($keysetarr); $jwt = JWT::decode($jwtparam, $keys); } catch (Exception $e) { @@ -1332,7 +1331,10 @@ function lti_verify_with_keyset($jwtparam, $keyseturl, $clientid) { $keysetarr = json_decode($keyset, true); // Fix for firebase/php-jwt's dependency on the optional 'alg' property in the JWK. + // The fix_jwks_alg() call only fixes a single, matched key and will leave others present (which may be missing alg too), + // Remaining keys missing alg are excluded since they cannot be used for decoding anyway (no match to JWT kid). $keysetarr = jwks_helper::fix_jwks_alg($keysetarr, $jwtparam); + $keysetarr['keys'] = array_filter($keysetarr['keys'], fn($key) => isset($key['alg'])); // JWK::parseKeySet uses RS256 algorithm by default. $keys = JWK::parseKeySet($keysetarr);