Bump github.com/golang-jwt/jwt to v5 (#25975)

Bumping `github.com/golang-jwt/jwt` from v4 to v5.

`github.com/golang-jwt/jwt` v5 is bringing some breaking changes:

- standard `Valid()` method on claims is removed. It's replaced by
`ClaimsValidator` interface implementing `Validator()` method instead,
which is called after standard validation. Gitea doesn't seem to be
using this logic.
- `jwt.Token` has a field `Valid`, so it's checked in `ParseToken`
function in `services/auth/source/oauth2/token.go`

---------

Co-authored-by: Giteabot <teabot@gitea.io>

diff --git a/assets/go-licenses.json b/assets/go-licenses.json
index bd541e7e904b8ff64d8415b18fd613ef9f141514..87f13ad9d58f0c75497c526d78fc31943075bceb 100644 (file)
--- a/assets/go-licenses.json
+++ b/assets/go-licenses.json
@@ -499,6 +499,11 @@
     "path": "github.com/golang-jwt/jwt/v4/LICENSE",
     "licenseText": "Copyright (c) 2012 Dave Grijalva\nCopyright (c) 2021 golang-jwt maintainers\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\n"
   },
+  {
+    "name": "github.com/golang-jwt/jwt/v5",
+    "path": "github.com/golang-jwt/jwt/v5/LICENSE",
+    "licenseText": "Copyright (c) 2012 Dave Grijalva\nCopyright (c) 2021 golang-jwt maintainers\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n\n"
+  },
   {
     "name": "github.com/golang-sql/civil",
     "path": "github.com/golang-sql/civil/LICENSE",

diff --git a/cmd/serv.go b/cmd/serv.go
index 484e3bf4048a8298f53f28df05cbcb6d21c2e33f..6b5cb78667e09a3062f079ebbbdb1e86197aa5e8 100644 (file)
--- a/cmd/serv.go
+++ b/cmd/serv.go
@@ -30,7 +30,7 @@ import (
        "code.gitea.io/gitea/modules/setting"
        "code.gitea.io/gitea/services/lfs"
 
-       "github.com/golang-jwt/jwt/v4"
+       "github.com/golang-jwt/jwt/v5"
        "github.com/kballard/go-shellquote"
        "github.com/urfave/cli"
 )

diff --git a/go.mod b/go.mod
index 9ba54ed185487906c0042077ba1144b738ee4623..2b784674d08c3c0ee7503fbeef9ebafc2547ab64 100644 (file)
--- a/go.mod
+++ b/go.mod
@@ -49,12 +49,12 @@ require (
        github.com/go-sql-driver/mysql v1.7.1
        github.com/go-swagger/go-swagger v0.30.5
        github.com/go-testfixtures/testfixtures/v3 v3.9.0
-       github.com/go-webauthn/webauthn v0.8.4
+       github.com/go-webauthn/webauthn v0.8.6
        github.com/gobwas/glob v0.2.3
        github.com/gogs/chardet v0.0.0-20211120154057-b7413eaefb8f
        github.com/gogs/cron v0.0.0-20171120032916-9f6c956d3e14
        github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85
-       github.com/golang-jwt/jwt/v4 v4.5.0
+       github.com/golang-jwt/jwt/v5 v5.0.0
        github.com/google/go-github/v53 v53.2.0
        github.com/google/pprof v0.0.0-20230705174524-200ffdc848b8
        github.com/google/uuid v1.3.0
@@ -196,6 +196,7 @@ require (
        github.com/go-openapi/validate v0.22.1 // indirect
        github.com/go-webauthn/x v0.1.4 // indirect
        github.com/goccy/go-json v0.10.2 // indirect
+       github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
        github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 // indirect
        github.com/golang-sql/sqlexp v0.1.0 // indirect
        github.com/golang/geo v0.0.0-20230421003525-6adc56603217 // indirect

diff --git a/go.sum b/go.sum
index 5f2704fddbdeb28bb81597a505cc402db007497a..8018ceb027ab0c4f1f8ec6320e57f4086c4bce85 100644 (file)
--- a/go.sum
+++ b/go.sum
@@ -455,8 +455,8 @@ github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg78
 github.com/go-test/deep v1.0.7 h1:/VSMRlnY/JSyqxQUzQLKVMAskpY/NZKFA5j2P+0pP2M=
 github.com/go-testfixtures/testfixtures/v3 v3.9.0 h1:938g5V+GWLVejm3Hc+nWCuEXRlcglZDDlN/t1gWzcSY=
 github.com/go-testfixtures/testfixtures/v3 v3.9.0/go.mod h1:cdsKD2ApFBjdog9jRsz6EJqF+LClq/hrwE9K/1Dzo4s=
-github.com/go-webauthn/webauthn v0.8.4 h1:/emQ9b9Rj4flWO94Fo8KJeYvZ6VzPywXsmqyDA/WicY=
-github.com/go-webauthn/webauthn v0.8.4/go.mod h1:ZqEa9OnSCdQf6CJvTWTDCsUcPRi8F3h7XCIDINwbBgI=
+github.com/go-webauthn/webauthn v0.8.6 h1:bKMtL1qzd2WTFkf1mFTVbreYrwn7dsYmEPjTq6QN90E=
+github.com/go-webauthn/webauthn v0.8.6/go.mod h1:emwVLMCI5yx9evTTvr0r+aOZCdWJqMfbRhF0MufyUog=
 github.com/go-webauthn/x v0.1.4 h1:sGmIFhcY70l6k7JIDfnjVBiAAFEssga5lXIUXe0GtAs=
 github.com/go-webauthn/x v0.1.4/go.mod h1:75Ug0oK6KYpANh5hDOanfDI+dvPWHk788naJVG/37H8=
 github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
@@ -504,6 +504,8 @@ github.com/gogs/go-gogs-client v0.0.0-20210131175652-1d7215cd8d85/go.mod h1:fR6z
 github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
 github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
 github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang-jwt/jwt/v5 v5.0.0 h1:1n1XNM9hk7O9mnQoNBGolZvzebBQ7p93ULHRc28XJUE=
+github.com/golang-jwt/jwt/v5 v5.0.0/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
 github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=

diff --git a/modules/generate/generate.go b/modules/generate/generate.go
index f29634e05e66352e2a66f61f9cc9c9b1d5a202fd..8b82976e85f3c85ff093e82b8ad3bbccf7676699 100644 (file)
--- a/modules/generate/generate.go
+++ b/modules/generate/generate.go
@@ -12,7 +12,7 @@ import (
 
        "code.gitea.io/gitea/modules/util"
 
-       "github.com/golang-jwt/jwt/v4"
+       "github.com/golang-jwt/jwt/v5"
 )
 
 // NewInternalToken generate a new value intended to be used by INTERNAL_TOKEN.

diff --git a/routers/web/auth/oauth.go b/routers/web/auth/oauth.go
index db15bf2e3d1a5c36c737acd24a7af12721b74118..3c367b3d27ff6e6fae846e1dc0753f0d431d6207 100644 (file)
--- a/routers/web/auth/oauth.go
+++ b/routers/web/auth/oauth.go
@@ -37,7 +37,7 @@ import (
        user_service "code.gitea.io/gitea/services/user"
 
        "gitea.com/go-chi/binding"
-       "github.com/golang-jwt/jwt/v4"
+       "github.com/golang-jwt/jwt/v5"
        "github.com/markbates/goth"
        "github.com/markbates/goth/gothic"
        go_oauth2 "golang.org/x/oauth2"
@@ -342,17 +342,15 @@ func IntrospectOAuth(ctx *context.Context) {
        form := web.GetForm(ctx).(*forms.IntrospectTokenForm)
        token, err := oauth2.ParseToken(form.Token, oauth2.DefaultSigningKey)
        if err == nil {
-               if token.Valid() == nil {
-                       grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)
-                       if err == nil && grant != nil {
-                               app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)
-                               if err == nil && app != nil {
-                                       response.Active = true
-                                       response.Scope = grant.Scope
-                                       response.Issuer = setting.AppURL
-                                       response.Audience = []string{app.ClientID}
-                                       response.Subject = fmt.Sprint(grant.UserID)
-                               }
+               grant, err := auth.GetOAuth2GrantByID(ctx, token.GrantID)
+               if err == nil && grant != nil {
+                       app, err := auth.GetOAuth2ApplicationByID(ctx, grant.ApplicationID)
+                       if err == nil && app != nil {
+                               response.Active = true
+                               response.Scope = grant.Scope
+                               response.Issuer = setting.AppURL
+                               response.Audience = []string{app.ClientID}
+                               response.Subject = fmt.Sprint(grant.UserID)
                        }
                }
        }

diff --git a/routers/web/auth/oauth_test.go b/routers/web/auth/oauth_test.go
index adf933fd239bfbb0b33a3f1bd4fd1ccc78fd716e..4339d9d1ebae8a9f03dc701497f737e0d6b6ad0e 100644 (file)
--- a/routers/web/auth/oauth_test.go
+++ b/routers/web/auth/oauth_test.go
@@ -13,7 +13,7 @@ import (
        "code.gitea.io/gitea/modules/setting"
        "code.gitea.io/gitea/services/auth/source/oauth2"
 
-       "github.com/golang-jwt/jwt/v4"
+       "github.com/golang-jwt/jwt/v5"
        "github.com/stretchr/testify/assert"
 )
 

diff --git a/services/auth/source/oauth2/jwtsigningkey.go b/services/auth/source/oauth2/jwtsigningkey.go
index 33bd3648e717fc16bcc7dc79251ccfd45e144d55..ff0d426e2239cf3596221443a2fe2fa417d94a37 100644 (file)
--- a/services/auth/source/oauth2/jwtsigningkey.go
+++ b/services/auth/source/oauth2/jwtsigningkey.go
@@ -22,7 +22,7 @@ import (
        "code.gitea.io/gitea/modules/setting"
        "code.gitea.io/gitea/modules/util"
 
-       "github.com/golang-jwt/jwt/v4"
+       "github.com/golang-jwt/jwt/v5"
 )
 
 // ErrInvalidAlgorithmType represents an invalid algorithm error.

diff --git a/services/auth/source/oauth2/token.go b/services/auth/source/oauth2/token.go
index 612c9db8cf5f0bbce47c95ee8de82f23700bb0b1..3405619d3fa59abbf565c4f2f2171bc733615583 100644 (file)
--- a/services/auth/source/oauth2/token.go
+++ b/services/auth/source/oauth2/token.go
@@ -9,7 +9,7 @@ import (
 
        "code.gitea.io/gitea/modules/timeutil"
 
-       "github.com/golang-jwt/jwt/v4"
+       "github.com/golang-jwt/jwt/v5"
 )
 
 // ___________     __
@@ -50,6 +50,9 @@ func ParseToken(jwtToken string, signingKey JWTSigningKey) (*Token, error) {
        if err != nil {
                return nil, err
        }
+       if !parsedToken.Valid {
+               return nil, fmt.Errorf("invalid token")
+       }
        var token *Token
        var ok bool
        if token, ok = parsedToken.Claims.(*Token); !ok || !parsedToken.Valid {

diff --git a/services/lfs/server.go b/services/lfs/server.go
index cc0ec73105bd772946b87151a7af8eaf4000161b..58b4663345ca6d6243b8d529a5fb617087716626 100644 (file)
--- a/services/lfs/server.go
+++ b/services/lfs/server.go
@@ -32,7 +32,7 @@ import (
        "code.gitea.io/gitea/modules/setting"
        "code.gitea.io/gitea/modules/storage"
 
-       "github.com/golang-jwt/jwt/v4"
+       "github.com/golang-jwt/jwt/v5"
        "github.com/minio/sha256-simd"
 )
 

diff --git a/services/packages/auth.go b/services/packages/auth.go
index 41d3a0a82511eaecb747eb022163d67665879613..2f78b26f506e286e6334a036ec1b54208f69df38 100644 (file)
--- a/services/packages/auth.go
+++ b/services/packages/auth.go
@@ -13,7 +13,7 @@ import (
        "code.gitea.io/gitea/modules/log"
        "code.gitea.io/gitea/modules/setting"
 
-       "github.com/golang-jwt/jwt/v4"
+       "github.com/golang-jwt/jwt/v5"
 )
 
 type packageClaims struct {