Skip to content

Conversation

@oxisto
Copy link
Collaborator

@oxisto oxisto commented Nov 8, 2022

Embedding a pointer version of jwt.RegisteredClaims in a custom claim and passing it to ParseWithClaims without memory allocation will lead to a crash if an empty token is presented (see #223). Unfortunately, we cannot really check for this in the function without MAJOR reflection magic, so I fear, all we can do at the moment is adjust the example and add a better description.

Copy link
Member

@mfridman mfridman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, I scanned through the GH issues and a few folks have run into this. So maybe this is for the best.

I don't think we should do any more than this.

@oxisto oxisto merged commit 2101c1f into main Nov 8, 2022
@oxisto oxisto deleted the no-pointer-embed branch November 8, 2022 14:43
mend-for-github-com bot referenced this pull request in DelineaXPM/dsv-cli Jan 19, 2023
…v4.4.3 (#42) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/golang-jwt/jwt/v4](https://togithub.com/golang-jwt/jwt) | require | patch | `v4.4.2` -> `v4.4.3` | --- ### ⚠ Dependency Lookup Warnings ⚠ Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information. --- ### Release Notes <details> <summary>golang-jwt/jwt</summary> ### [`v4.4.3`](https://togithub.com/golang-jwt/jwt/releases/tag/v4.4.3) [Compare Source](https://togithub.com/golang-jwt/jwt/compare/v4.4.2...v4.4.3) #### What's Changed - fix: link update for README.md for v4 by [@&#8203;krokite](https://togithub.com/krokite) in [https://github.com/golang-jwt/jwt/pull/217](https://togithub.com/golang-jwt/jwt/pull/217) - Implement a BearerExtractor by [@&#8203;WhyNotHugo](https://togithub.com/WhyNotHugo) in [https://github.com/golang-jwt/jwt/pull/226](https://togithub.com/golang-jwt/jwt/pull/226) - Bump matrix to support latest go version (go1.19) by [@&#8203;mfridman](https://togithub.com/mfridman) in [https://github.com/golang-jwt/jwt/pull/231](https://togithub.com/golang-jwt/jwt/pull/231) - Include https://github.com/golang-jwt/jwe in README by [@&#8203;oxisto](https://togithub.com/oxisto) in [https://github.com/golang-jwt/jwt/pull/229](https://togithub.com/golang-jwt/jwt/pull/229) - Add doc comment to ParseWithClaims by [@&#8203;jkopczyn](https://togithub.com/jkopczyn) in [https://github.com/golang-jwt/jwt/pull/232](https://togithub.com/golang-jwt/jwt/pull/232) - Refactor: removed the unneeded if statement by [@&#8203;Krout0n](https://togithub.com/Krout0n) in [https://github.com/golang-jwt/jwt/pull/241](https://togithub.com/golang-jwt/jwt/pull/241) - No pointer embedding in the example by [@&#8203;oxisto](https://togithub.com/oxisto) in [https://github.com/golang-jwt/jwt/pull/255](https://togithub.com/golang-jwt/jwt/pull/255) #### New Contributors - [@&#8203;krokite](https://togithub.com/krokite) made their first contribution in [https://github.com/golang-jwt/jwt/pull/217](https://togithub.com/golang-jwt/jwt/pull/217) - [@&#8203;WhyNotHugo](https://togithub.com/WhyNotHugo) made their first contribution in [https://github.com/golang-jwt/jwt/pull/226](https://togithub.com/golang-jwt/jwt/pull/226) - [@&#8203;jkopczyn](https://togithub.com/jkopczyn) made their first contribution in [https://github.com/golang-jwt/jwt/pull/232](https://togithub.com/golang-jwt/jwt/pull/232) - [@&#8203;Krout0n](https://togithub.com/Krout0n) made their first contribution in [https://github.com/golang-jwt/jwt/pull/241](https://togithub.com/golang-jwt/jwt/pull/241) **Full Changelog**: golang-jwt/jwt@v4.4.2...v4.4.3 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 3am on Monday" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, click this checkbox. <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzMi4yMjkuMCIsInVwZGF0ZWRJblZlciI6IjMyLjIyOS4wIn0=--> Co-authored-by: mend-for-github-com[bot] <50673670+mend-for-github-com[bot]@users.noreply.github.com>
kodiakhq bot referenced this pull request in cloudquery/cloudquery Feb 1, 2023
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [github.com/golang-jwt/jwt/v4](https://togithub.com/golang-jwt/jwt) | indirect | patch | `v4.4.2` -> `v4.4.3` | --- ### Release Notes <details> <summary>golang-jwt/jwt</summary> ### [`v4.4.3`](https://togithub.com/golang-jwt/jwt/releases/tag/v4.4.3): 4.4.3 [Compare Source](https://togithub.com/golang-jwt/jwt/compare/v4.4.2...v4.4.3) ##### What's Changed - fix: link update for README.md for v4 by [@&#8203;krokite](https://togithub.com/krokite) in [https://github.com/golang-jwt/jwt/pull/217](https://togithub.com/golang-jwt/jwt/pull/217) - Implement a BearerExtractor by [@&#8203;WhyNotHugo](https://togithub.com/WhyNotHugo) in [https://github.com/golang-jwt/jwt/pull/226](https://togithub.com/golang-jwt/jwt/pull/226) - Bump matrix to support latest go version (go1.19) by [@&#8203;mfridman](https://togithub.com/mfridman) in [https://github.com/golang-jwt/jwt/pull/231](https://togithub.com/golang-jwt/jwt/pull/231) - Include https://github.com/golang-jwt/jwe in README by [@&#8203;oxisto](https://togithub.com/oxisto) in [https://github.com/golang-jwt/jwt/pull/229](https://togithub.com/golang-jwt/jwt/pull/229) - Add doc comment to ParseWithClaims by [@&#8203;jkopczyn](https://togithub.com/jkopczyn) in [https://github.com/golang-jwt/jwt/pull/232](https://togithub.com/golang-jwt/jwt/pull/232) - Refactor: removed the unneeded if statement by [@&#8203;Krout0n](https://togithub.com/Krout0n) in [https://github.com/golang-jwt/jwt/pull/241](https://togithub.com/golang-jwt/jwt/pull/241) - No pointer embedding in the example by [@&#8203;oxisto](https://togithub.com/oxisto) in [https://github.com/golang-jwt/jwt/pull/255](https://togithub.com/golang-jwt/jwt/pull/255) ##### New Contributors - [@&#8203;krokite](https://togithub.com/krokite) made their first contribution in [https://github.com/golang-jwt/jwt/pull/217](https://togithub.com/golang-jwt/jwt/pull/217) - [@&#8203;WhyNotHugo](https://togithub.com/WhyNotHugo) made their first contribution in [https://github.com/golang-jwt/jwt/pull/226](https://togithub.com/golang-jwt/jwt/pull/226) - [@&#8203;jkopczyn](https://togithub.com/jkopczyn) made their first contribution in [https://github.com/golang-jwt/jwt/pull/232](https://togithub.com/golang-jwt/jwt/pull/232) - [@&#8203;Krout0n](https://togithub.com/Krout0n) made their first contribution in [https://github.com/golang-jwt/jwt/pull/241](https://togithub.com/golang-jwt/jwt/pull/241) **Full Changelog**: golang-jwt/jwt@v4.4.2...v4.4.3 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "before 3am on the first day of the month" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC45NC4wIiwidXBkYXRlZEluVmVyIjoiMzQuOTQuMCJ9-->
oxisto added a commit to moneszarrugh/jwt that referenced this pull request Feb 21, 2023
oxisto added a commit to twocs/jwt that referenced this pull request Mar 29, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

3 participants