Skip to content

Update deprecated base64 function in rems.jwt/show #3457

Description

@pikariop

clj-kondo #'buddy.core.codecs.base64/decode is deprecated since 1.7.1 src/clj/rems/jwt.clj:62:13

Change implementation to use the non-deprecated function, likely b64->bytes or the newer b64->str in the buddy.core.codecs namespace. Also, the inline function with .getBytes could possibly be replaced with buddy.core.codecs/->bytes. However, simply dropping in b64->bytes throws an exception "illegal base64 character 2e", which is the dot (.) character, which likely comes from the earlier clojure.string/split using the third parameter limit (2). Apparently buddy.core.codecs uses a different Java library for base64 operations than buddy.core.codecs.base64, which seems to happily accept the dot. Removing the limit and instead taking the first two parts seems to do the trick. To paraphrase the test,

(let [jwt "eyJhbGciOiJSUzI1NiIsImprdSI6Imh0dHA6Ly9sb2NhbGhvc3Q6MzAwMC9hcGkvandrIiwidHlwIjoiSldUIiwia2lkIjoiMjAxMS0wNC0yOSJ9.eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjMwMDAvIiwic3ViIjoiZWxpeGlyLXVzZXIiLCJpYXQiOjI1MjQ2MDgwMDAsImV4cCI6MjU1NjE0NDAwMCwiZ2E0Z2hfdmlzYV92MSI6eyJ0eXBlIjoiQ29udHJvbGxlZEFjY2Vzc0dyYW50cyIsInZhbHVlIjoiRUdBRDAwMDAxMDA2NjczIiwic291cmNlIjoiRUdBQzAwMDAxMDAwOTA4IiwiYnkiOiJkYWMiLCJhc3NlcnRlZCI6MTAzNDI5NDQwMH19.LnfsNxVfM_NfuxYYQtZexp975Hc3hrCxTG0fhMrgTakSLXa6gASc5MPn14seqsTjuyhtmUnu7WrCEVxko8WRvJybGDWmdbrycYafNg4amevtbs7hTPCkqAXD1DcuP53LDeLhSl_YrNgfz4aDE0uaw37I8TAsqdAeDALcZqQ6SIwF5wBG_wRWtKTPmDp-GTpzy9STx-nrIqw3SYeftunlI4wDs5avaktDuOpgMl8TVUGodGFjJsZjN8UOhKgSsGdXDGmu4FeeIjJt9Sa_dsCQPZQ1GpHyg1lFa63FZPPOy2-F9TNZcHJR1vFxKLD9U8Lvr11-EFjIiGuDg6miiWyodw"]
       (= [{:alg "RS256"
            :kid "2011-04-29"
            :jku "http://localhost:3000/api/jwk"
            :typ "JWT"}
           {:sub "elixir-user"
            :iss "http://localhost:3000/"
            :exp 2556144000
            :ga4gh_visa_v1 {:value "EGAD00001006673"
                            :type "ControlledAccessGrants"
                            :source "EGAC00001000908"
                            :asserted 1034294400
                            :by "dac"}
            :iat 2524608000}]
          (into [] 
                (comp (take 2)
                      (map buddy.core.codecs/->bytes)
                      (map buddy.core.codecs/b64->str)
                      (map rems.json/parse-string))
                (clojure.string/split jwt #"\."))))
;;=> true

Additionally, buddy-core is missing from project.clj, it's required by buddy-sign but it would be good to include it since we refer to it directly in rems.jwt and a couple of other namespaces as well.

https://funcool.github.io/buddy-core/latest/buddy.core.codecs.html

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Technical DebtImproving internal product quality

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions