Example code is memory insecure

[lggomez]

Migrated from dgrijalva/jwt-go#441:

Comments
@gardc
gardc commented on Nov 21, 2020 •

Referring to this example (https://godoc.org/github.com/dgrijalva/jwt-go#example-Parse--Hmac) pointed to by the readme, feeding it an invalid JWT will create a memory panic.

Go playground example. (https://play.golang.org/p/wyOgm21FYE8)

Checking for err and token.Valid before assuming it's all good in the hood fixes the issue, Go playground example. (https://play.golang.org/p/0sX-54gXfE2)

[lggomez]

@johnbalvin
johnbalvin commented on Nov 26, 2020

just check the error https://play.golang.org/p/LG0AFYMhGQm

[lggomez]

FWIW, here's the repro using this package: https://play.golang.org/p/ym1qpfvFdZS

[lggomez]

Related issue: dgrijalva/jwt-go#379

[jackaitken]

Could I raise a PR to fix this example?

[oxisto]

Could I raise a PR to fix this example?

Sure go ahead, although I am not sure if we already fixed this over time now