Handle base64 decoding correctly to avoid panic (#26483)

Fix the panic if the "base64 secret" is too long.

1 files changed, 1 insertions, 10 deletions

diff --git a/services/auth/source/oauth2/jwtsigningkey.go b/services/auth/source/oauth2/jwtsigningkey.go
index ff0d426e22..eca0b8b7e1 100644
--- a/services/auth/source/oauth2/jwtsigningkey.go
+++ b/services/auth/source/oauth2/jwtsigningkey.go
@@ -336,16 +336,7 @@ func InitSigningKey() error {
 // loadSymmetricKey checks if the configured secret is valid.
 // If it is not valid, it will return an error.
 func loadSymmetricKey() (any, error) {
-	key := make([]byte, 32)
-	n, err := base64.RawURLEncoding.Decode(key, []byte(setting.OAuth2.JWTSecretBase64))
-	if err != nil {
-		return nil, err
-	}
-	if n != 32 {
-		return nil, fmt.Errorf("JWT secret must be 32 bytes long")
-	}
-
-	return key, nil
+	return util.Base64FixedDecode(base64.RawURLEncoding, []byte(setting.OAuth2.JWTSecretBase64), 32)
 }
 
 // loadOrCreateAsymmetricKey checks if the configured private key exists.