Skip to content

Commit de8cb88

Browse files
pulak-optipulak-opti
authored
[FSSDK-9972] fix dependabot moderate alerts (#416)
* update dependencies * update unit tests
1 parent 56d9dca commit de8cb88

File tree

6 files changed

+58
-27
lines changed

6 files changed

+58
-27
lines changed

‎examples/requirements.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,5 @@ certifi>=2023.7.22
22
chardet==3.0.4
33
idna==2.9
44
requests==2.23.0
5-
urllib3==1.26.5
5+
urllib3==1.26.18
66
sseclient==0.0.26

‎go.mod

+12-4
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ require (
1111
github.com/go-redis/redis/v8 v8.11.5
1212
github.com/golang-jwt/jwt/v4 v4.5.0
1313
github.com/google/uuid v1.3.1
14-
github.com/lestrrat-go/jwx v0.9.0
14+
github.com/lestrrat-go/jwx/v2 v2.0.20
1515
github.com/optimizely/go-sdk/v2 v2.0.0
1616
github.com/orcaman/concurrent-map v1.0.0
1717
github.com/prometheus/client_golang v1.18.0
@@ -26,22 +26,30 @@ require (
2626
go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.21.0
2727
go.opentelemetry.io/otel/sdk v1.21.0
2828
go.opentelemetry.io/otel/trace v1.21.0
29-
golang.org/x/crypto v0.14.0
29+
golang.org/x/crypto v0.19.0
3030
golang.org/x/sync v0.3.0
3131
gopkg.in/yaml.v2 v2.4.0
3232
)
3333

3434
require (
3535
github.com/beorn7/perks v1.0.1 // indirect
3636
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
37+
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 // indirect
3738
github.com/go-logr/logr v1.3.0 // indirect
3839
github.com/go-logr/stdr v1.2.2 // indirect
40+
github.com/goccy/go-json v0.10.2 // indirect
3941
github.com/golang/protobuf v1.5.3 // indirect
4042
github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
43+
github.com/lestrrat-go/blackmagic v1.0.2 // indirect
44+
github.com/lestrrat-go/httpcc v1.0.1 // indirect
45+
github.com/lestrrat-go/httprc v1.0.4 // indirect
46+
github.com/lestrrat-go/iter v1.0.2 // indirect
47+
github.com/lestrrat-go/option v1.0.1 // indirect
4148
github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
4249
github.com/prometheus/client_model v0.5.0 // indirect
4350
github.com/prometheus/common v0.45.0 // indirect
4451
github.com/prometheus/procfs v0.12.0 // indirect
52+
github.com/segmentio/asm v1.2.0 // indirect
4553
go.opentelemetry.io/otel/metric v1.21.0 // indirect
4654
go.opentelemetry.io/proto/otlp v1.0.0 // indirect
4755
golang.org/x/net v0.17.0 // indirect
@@ -79,8 +87,8 @@ require (
7987
github.com/stretchr/objx v0.5.0 // indirect
8088
github.com/subosito/gotenv v1.4.2 // indirect
8189
github.com/twmb/murmur3 v1.1.6 // indirect
82-
golang.org/x/sys v0.15.0 // indirect
83-
golang.org/x/text v0.13.0 // indirect
90+
golang.org/x/sys v0.17.0 // indirect
91+
golang.org/x/text v0.14.0 // indirect
8492
gopkg.in/ini.v1 v1.67.0 // indirect
8593
gopkg.in/yaml.v3 v3.0.1 // indirect
8694
)

‎go.sum

+25-8
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,8 @@ github.com/coreos/go-systemd/v22 v22.3.3-0.20220203105225-a9a7ef127534/go.mod h1
6060
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
6161
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
6262
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
63+
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0 h1:8UrgZ3GkP4i/CLijOJx79Yu+etlyjdBU4sfcs2WYQMs=
64+
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0/go.mod h1:v57UDF4pDQJcEfFUCRop3lJL149eHGSe9Jvczhzjo/0=
6365
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
6466
github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
6567
github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -95,6 +97,8 @@ github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
9597
github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
9698
github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
9799
github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
100+
github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
101+
github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
98102
github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
99103
github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
100104
github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
@@ -189,8 +193,18 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
189193
github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
190194
github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
191195
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
192-
github.com/lestrrat-go/jwx v0.9.0 h1:Fnd0EWzTm0kFrBPzE/PEPp9nzllES5buMkksPMjEKpM=
193-
github.com/lestrrat-go/jwx v0.9.0/go.mod h1:iEoxlYfZjvoGpuWwxUz+eR5e6KTJGsaRcy/YNA/UnBk=
196+
github.com/lestrrat-go/blackmagic v1.0.2 h1:Cg2gVSc9h7sz9NOByczrbUvLopQmXrfFx//N+AkAr5k=
197+
github.com/lestrrat-go/blackmagic v1.0.2/go.mod h1:UrEqBzIR2U6CnzVyUtfM6oZNMt/7O7Vohk2J0OGSAtU=
198+
github.com/lestrrat-go/httpcc v1.0.1 h1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=
199+
github.com/lestrrat-go/httpcc v1.0.1/go.mod h1:qiltp3Mt56+55GPVCbTdM9MlqhvzyuL6W/NMDA8vA5E=
200+
github.com/lestrrat-go/httprc v1.0.4 h1:bAZymwoZQb+Oq8MEbyipag7iSq6YIga8Wj6GOiJGdI8=
201+
github.com/lestrrat-go/httprc v1.0.4/go.mod h1:mwwz3JMTPBjHUkkDv/IGJ39aALInZLrhBp0X7KGUZlo=
202+
github.com/lestrrat-go/iter v1.0.2 h1:gMXo1q4c2pHmC3dn8LzRhJfP1ceCbgSiT9lUydIzltI=
203+
github.com/lestrrat-go/iter v1.0.2/go.mod h1:Momfcq3AnRlRjI5b5O8/G5/BvpzrhoFTZcn06fEOPt4=
204+
github.com/lestrrat-go/jwx/v2 v2.0.20 h1:sAgXuWS/t8ykxS9Bi2Qtn5Qhpakw1wrcjxChudjolCc=
205+
github.com/lestrrat-go/jwx/v2 v2.0.20/go.mod h1:UlCSmKqw+agm5BsOBfEAbTvKsEApaGNqHAEUTv5PJC4=
206+
github.com/lestrrat-go/option v1.0.1 h1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=
207+
github.com/lestrrat-go/option v1.0.1/go.mod h1:5ZHFbivi4xwXxhxY9XHDe2FHo6/Z7WWmtT7T5nBBp3I=
194208
github.com/magiconair/properties v1.8.7 h1:IeQXZAiQcpL9mgcAe1Nu6cX9LLw6ExEHKjN0VQdvPDY=
195209
github.com/magiconair/properties v1.8.7/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
196210
github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
@@ -245,6 +259,8 @@ github.com/rs/xid v1.4.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
245259
github.com/rs/zerolog v1.27.0/go.mod h1:7frBqO0oezxmnO7GF86FY++uy8I0Tk/If5ni1G9Qc0U=
246260
github.com/rs/zerolog v1.29.0 h1:Zes4hju04hjbvkVkOhdl2HpZa+0PmVwigmo8XoORE5w=
247261
github.com/rs/zerolog v1.29.0/go.mod h1:NILgTygv/Uej1ra5XxGf82ZFSLk58MFGAUS2o6usyD0=
262+
github.com/segmentio/asm v1.2.0 h1:9BQrFxC+YOHJlTlHGkTrFWf59nbL3XnCoFLTwDCI7ys=
263+
github.com/segmentio/asm v1.2.0/go.mod h1:BqMnlJP91P8d+4ibuonYZw9mfnzI9HfxselHZr5aAcs=
248264
github.com/spf13/afero v1.9.4 h1:Sd43wM1IWz/s1aVXdOBkjJvuP8UdyqioeE4AmM0QsBs=
249265
github.com/spf13/afero v1.9.4/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
250266
github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
@@ -263,6 +279,7 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
263279
github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
264280
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
265281
github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
282+
github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
266283
github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
267284
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
268285
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
@@ -310,8 +327,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
310327
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
311328
golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
312329
golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
313-
golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
314-
golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
330+
golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo=
331+
golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
315332
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
316333
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
317334
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -438,17 +455,17 @@ golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBc
438455
golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
439456
golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
440457
golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
441-
golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc=
442-
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
458+
golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
459+
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
443460
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
444461
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
445462
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
446463
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
447464
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
448465
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
449466
golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
450-
golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
451-
golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
467+
golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
468+
golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
452469
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
453470
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
454471
golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

‎pkg/middleware/auth.go

+15-9
Original file line numberDiff line numberDiff line change
@@ -18,19 +18,20 @@
1818
package middleware
1919

2020
import (
21+
"context"
2122
"errors"
2223
"fmt"
2324
"net/http"
2425
"strings"
2526
"sync"
2627
"time"
2728

28-
"github.com/optimizely/agent/config"
29-
"github.com/optimizely/agent/pkg/jwtauth"
30-
3129
"github.com/golang-jwt/jwt/v4"
32-
"github.com/lestrrat-go/jwx/jwk"
30+
"github.com/lestrrat-go/jwx/v2/jwk"
3331
"github.com/rs/zerolog/log"
32+
33+
"github.com/optimizely/agent/config"
34+
"github.com/optimizely/agent/pkg/jwtauth"
3435
)
3536

3637
func getNumberFromJSON(val interface{}) int64 {
@@ -108,7 +109,7 @@ type JWTVerifierURL struct {
108109
jwksURL string
109110

110111
parser *jwt.Parser
111-
jwksKeys *jwk.Set
112+
jwksKeys jwk.Set
112113
jwksLock sync.RWMutex
113114
}
114115

@@ -130,15 +131,15 @@ func (c *JWTVerifierURL) updateKeySet() error {
130131
c.jwksLock.Lock()
131132
defer c.jwksLock.Unlock()
132133

133-
set, err := jwk.Fetch(c.jwksURL)
134+
set, err := jwk.Fetch(context.TODO(), c.jwksURL)
134135
if err != nil {
135136
return err
136137
}
137138
c.jwksKeys = set
138139
return nil
139140
}
140141

141-
func (c *JWTVerifierURL) getKeySet() *jwk.Set {
142+
func (c *JWTVerifierURL) getKeySet() jwk.Set {
142143
c.jwksLock.RLock()
143144
defer c.jwksLock.RUnlock()
144145
return c.jwksKeys
@@ -179,8 +180,13 @@ func (c *JWTVerifierURL) CheckToken(token string) (tk *jwt.Token, err error) {
179180
return nil, errors.New("expecting JWT header to have string kid")
180181
}
181182

182-
if key := set.LookupKeyID(keyID); len(key) == 1 {
183-
return key[0].Materialize()
183+
var rawKey interface{}
184+
key, found := set.LookupKeyID(keyID)
185+
if found {
186+
if err := key.Raw(&rawKey); err != nil {
187+
return nil, err
188+
}
189+
return rawKey, nil
184190
}
185191

186192
return nil, fmt.Errorf("unable to find key %q", keyID)

‎pkg/middleware/auth_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ import (
2525
"testing"
2626
"time"
2727

28-
"github.com/optimizely/agent/config"
29-
3028
"github.com/golang-jwt/jwt/v4"
3129
"github.com/stretchr/testify/assert"
3230
"github.com/stretchr/testify/suite"
31+
32+
"github.com/optimizely/agent/config"
3333
)
3434

3535
type OptlyClaims struct {
@@ -222,8 +222,8 @@ func (suite *AuthTestSuite) TestAuthValidCheckTokenFromValidJwks() {
222222

223223
auth.updateKeySet()
224224
token, err := auth.CheckToken(tk)
225-
suite.Equal(tk, token.Raw)
226225
suite.NoError(err)
226+
suite.Equal(tk, token.Raw)
227227
}
228228

229229
func (suite *AuthTestSuite) TestAuthValidCheckTokenFromInvalidJwksURL() {

‎tests/acceptance/requirements.txt

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
pytest==7.0.0
22
pytest-clarity==1.0.1
3-
requests==2.27.1
3+
requests==2.31.0
44
openapi_core==0.17.1
55
openapi_spec_validator==0.5.6
6-
redis==4.2.2
6+
redis==4.4.4

0 commit comments

Comments
 (0)