[3.27] 3.27.6 backports 4 - #56513
Open
jmartisk wants to merge 3 commits into
Open
Conversation
An empty or delimiter-only bearer token has zero StringTokenizer tokens, so the unguarded nextToken() in getJwtContentPart threw NoSuchElementException. That is not an AuthenticationFailedException, so it escaped BearerAuthenticationMechanism and AbstractHttpAuthorizer turned it into routingContext.fail(t) -- HTTP 500 plus an ERROR stack trace, remotely triggerable by any unauthenticated caller on any bearer-protected endpoint. The method already returns null for 'not a JWT', so hoisting a hasMoreTokens() check above the first nextToken() needs no caller changes: isOpaqueToken correctly returns true and the request falls through to normal 401 handling. decodeJwtHeaders and decodeJwtHeadersAsString in OidcUtils carried the identical unguarded call and are fixed the same way. Fixes quarkusio#55887 (cherry picked from commit 56247e9)
(cherry picked from commit 7fc6601)
Bumps [org.jsoup:jsoup](https://github.com/jhy/jsoup) from 1.23.1 to 1.23.2. - [Release notes](https://github.com/jhy/jsoup/releases) - [Changelog](https://github.com/jhy/jsoup/blob/master/CHANGES.md) - [Commits](jhy/jsoup@jsoup-1.23.1...jsoup-1.23.2) --- updated-dependencies: - dependency-name: org.jsoup:jsoup dependency-version: 1.23.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit 8a4538b)
|
Thanks for your pull request! Your pull request does not follow our editorial rules. Could you have a look?
This message is automatically generated by a bot. |
|
/cc @aloubyansky (3.27), @gsmet (3.27), @rsvoboda (3.27) |
quarkus-bot
Bot
added
area/dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.