fix: handle invalid http responses (#508)

Author: bshaffer

src/CachedKeySet.php

@@ -178,6 +178,16 @@ private function keyIdExists(string $keyId): bool
  }
  $request = $this->httpFactory->createRequest('GET', $this->jwksUri);
  $jwksResponse = $this->httpClient->sendRequest($request);
+ if ($jwksResponse->getStatusCode() !== 200) {
+ throw new UnexpectedValueException(
+ sprintf('HTTP Error: %d %s for URI "%s"',
+ $jwksResponse->getStatusCode(),
+ $jwksResponse->getReasonPhrase(),
+ $this->jwksUri,
+ ),
+ $jwksResponse->getStatusCode()
+ );
+ }
  $this->keySet = $this->formatJwksForCache((string) $jwksResponse->getBody());
 
  if (!isset($this->keySet[$keyId])) {

tests/CachedKeySetTest.php

@@ -88,6 +88,37 @@ public function testOutOfBoundsThrowsException()
  $cachedKeySet['bar'];
  }
 
+ public function testInvalidHttpResponseThrowsException()
+ {
+ $this->expectException(\UnexpectedValueException::class);
+ $this->expectExceptionMessage('HTTP Error: 404 URL not found');
+ $this->expectExceptionCode(404);
+
+ $body = $this->prophesize('Psr\Http\Message\StreamInterface');
+
+ $response = $this->prophesize('Psr\Http\Message\ResponseInterface');
+ $response->getStatusCode()
+ ->shouldBeCalled()
+ ->willReturn(404);
+ $response->getReasonPhrase()
+ ->shouldBeCalledTimes(1)
+ ->willReturn('URL not found');
+
+ $http = $this->prophesize(ClientInterface::class);
+ $http->sendRequest(Argument::any())
+ ->shouldBeCalledTimes(1)
+ ->willReturn($response->reveal());
+
+ $cachedKeySet = new CachedKeySet(
+ $this->testJwksUri,
+ $http->reveal(),
+ $this->getMockHttpFactory(),
+ $this->getMockEmptyCache()
+ );
+
+ isset($cachedKeySet[0]);
+ }
+
  public function testWithExistingKeyId()
  {
  $cachedKeySet = new CachedKeySet(
@@ -382,6 +413,9 @@ private function getMockHttpClient($testJwks, int $timesCalled = 1)
  $response->getBody()
  ->shouldBeCalledTimes($timesCalled)
  ->willReturn($body->reveal());
+ $response->getStatusCode()
+ ->shouldBeCalledTimes($timesCalled)
+ ->willReturn(200);
 
  $http = $this->prophesize(ClientInterface::class);
  $http->sendRequest(Argument::any())