Coverage

Author: yaronf

crypto.go

@@ -222,6 +222,9 @@ func NewHMACSHA256Verifier(keyID string, key []byte, config *VerifyConfig, field
 	if config == nil {
 		config = NewVerifyConfig()
 	}
+	if config.verifyKeyID && keyID == "" {
+		return nil, fmt.Errorf("keyID should not be empty")
+	}
 	return &Verifier{
 		keyID:  keyID,
 		key:    key,
@@ -237,6 +240,9 @@ func NewRSAVerifier(keyID string, key rsa.PublicKey, config *VerifyConfig, field
 	if config == nil {
 		config = NewVerifyConfig()
 	}
+	if config.verifyKeyID && keyID == "" {
+		return nil, fmt.Errorf("keyID should not be empty")
+	}
 	return &Verifier{
 		keyID:  keyID,
 		key:    key,
@@ -252,6 +258,9 @@ func NewRSAPSSVerifier(keyID string, key rsa.PublicKey, config *VerifyConfig, fi
 	if config == nil {
 		config = NewVerifyConfig()
 	}
+	if config.verifyKeyID && keyID == "" {
+		return nil, fmt.Errorf("keyID should not be empty")
+	}
 	return &Verifier{
 		keyID:  keyID,
 		key:    key,
@@ -267,6 +276,9 @@ func NewP256Verifier(keyID string, key ecdsa.PublicKey, config *VerifyConfig, fi
 	if config == nil {
 		config = NewVerifyConfig()
 	}
+	if config.verifyKeyID && keyID == "" {
+		return nil, fmt.Errorf("keyID should not be empty")
+	}
 	return &Verifier{
 		keyID:  keyID,
 		key:    key,
@@ -285,6 +297,9 @@ func NewEd25519Verifier(keyID string, key ed25519.PublicKey, config *VerifyConfi
 	if config == nil {
 		config = NewVerifyConfig()
 	}
+	if config.verifyKeyID && keyID == "" {
+		return nil, fmt.Errorf("keyID should not be empty")
+	}
 	return &Verifier{
 		keyID:  keyID,
 		key:    key,
@@ -301,6 +316,12 @@ func NewJWSVerifier(alg jwa.SignatureAlgorithm, key interface{}, keyID string, c
 	if key == nil {
 		return nil, fmt.Errorf("key must not be nil")
 	}
+	if config == nil {
+		config = NewVerifyConfig()
+	}
+	if config.verifyKeyID && keyID == "" {
+		return nil, fmt.Errorf("keyID should not be empty")
+	}
 	if alg == jwa.NoSignature {
 		return nil, fmt.Errorf("the NONE signing algorithm is expressly disallowed")
 	}

signatures_test.go

@@ -939,7 +939,7 @@ func TestVerifyRequest(t *testing.T) {
 			name: "test case B.2.1",
 			args: args{
 				signatureName: "sig-b21",
-				verifier:      makeRSAVerifier(t, *NewFields()),
+				verifier:      makeRSAVerifier(t, "test-key-rsa-pss", *NewFields()),
 				req:           readRequest(httpreq1pssMinimal),
 			},
 			want:    true,
@@ -1001,7 +1001,7 @@ func TestVerifyRequest(t *testing.T) {
 			name: "verify bad sig (not base64)",
 			args: args{
 				signatureName: "sig1",
-				verifier:      makeRSAVerifier(t, *NewFields()),
+				verifier:      makeRSAVerifier(t, "test-key-rsa-pss", *NewFields()),
 				req:           readRequest(httpreq1pssSelectiveBad),
 			},
 			want:    false,
@@ -1011,12 +1011,29 @@ func TestVerifyRequest(t *testing.T) {
 			name: "missing fields",
 			args: args{
 				signatureName: "sig1",
-				verifier:      makeRSAVerifier(t, *NewFields().AddQueryParam("missing")),
+				verifier:      makeRSAVerifier(t, "test-key-rsa-pss", *NewFields().AddQueryParam("missing")),
 				req:           readRequest(httpreq1pssMinimal),
 			},
 			want:    false,
 			wantErr: true,
 		},
+		{
+			name: "bad keyID",
+			args: args{
+				signatureName: "sig-b22",
+				verifier: (func() Verifier {
+					pubKey, err := parseRsaPublicKeyFromPemStr(rsaPSSPubKey)
+					if err != nil {
+						t.Errorf("cannot parse public key: %v", err)
+					}
+					verifier, _ := NewRSAPSSVerifier("bad-key-id", *pubKey, NewVerifyConfig().SetVerifyCreated(false), *NewFields())
+					return *verifier
+				})(),
+				req: readRequest(httpreq1pssSelective),
+			},
+			want:    false,
+			wantErr: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -1029,13 +1046,13 @@ func TestVerifyRequest(t *testing.T) {
 	}
 }
 
-func makeRSAVerifier(t *testing.T, fields Fields) Verifier {
+func makeRSAVerifier(t *testing.T, keyID string, fields Fields) Verifier {
 	return (func() Verifier {
 		pubKey, err := parseRsaPublicKeyFromPemStr(rsaPSSPubKey)
 		if err != nil {
 			t.Errorf("cannot parse public key: %v", err)
 		}
-		verifier, _ := NewRSAPSSVerifier("test-key-rsa-pss", *pubKey, NewVerifyConfig().SetVerifyCreated(false), fields)
+		verifier, _ := NewRSAPSSVerifier(keyID, *pubKey, NewVerifyConfig().SetVerifyCreated(false), fields)
 		return *verifier
 	})()
 }