3 ms·
At some point, that alg parameter gets resolved to an algorithm - an object or enum constant or something. This bug implies that the filtering was done on the s
by twic 7y ago
At some point, that alg parameter gets resolved to an algorithm - an object or enum constant or something. This bug implies that the filtering was done on the string value of the parameter, and not the resolved value. That seems like a schoolboy error.
- user5994461 7y agoIt's much worse than that. There are like 5 options for the algorithm value, none, RS256, HS256, etc... The vulnerabilities implies that they don't verify the value against the very limited list of possible values, which is incredibly stupid.