JWE with no "cty" where content accidentally looks like JSON cannot be decrypted with parseEncryptedContent

[tupelo-schneck]

Describe the bug

If I have a content JWE, and it has no "cty", and the payload content happens to be parseable as JSON, then parseEncryptedContent fails with io.jsonwebtoken.UnsupportedJwtException: Unexpected Claims JWE.

To Reproduce

    Password password = Keys.password("password".toCharArray());
    String jwe = Jwts.builder()
        .content(new byte[] { 0x7B, 0x7D })
        .encryptWith(password, Jwts.KEY.PBES2_HS512_A256KW, Jwts.ENC.A256GCM)
        .compact();
    byte[] payload =  Jwts.parser()
        .decryptWith(password)
        .build()
        .parseEncryptedContent(jwe)
        .getPayload();

This code throws io.jsonwebtoken.UnsupportedJwtException: Unexpected Claims JWE.

Expected behavior

I expect to get the content, which happens to be the two bytes corresponding to the characters '{' and '}'.

[lhazlewood]

Related: #897 (comment)

This is because parseEncryptedContent doesn't supply 'hints' down the call stack that the caller is explicitly requiring 'encrypted content' and not claims - it parses as normal, and then, when it finds JSON, treats it as Claims because there is no cty. This is expected behavior, but we can probably override this behavior because of the explicit desire to receive back content bytes.

[exijn]

Hi, I'd like to work on this issue.

I plan to first add a regression test using the provided reproduction, then trace how parseEncryptedContent() communicates the expected payload type to the internal parser.

Could you confirm whether overriding JSON claims detection specifically for parseEncryptedContent() is the intended direction?Hi, I'd like to work on this issue.

I plan to first add a regression test using the provided reproduction, then trace how parseEncryptedContent() communicates the expected payload type to the internal parser.

Could you confirm whether overriding JSON claims detection specifically for parseEncryptedContent() is the intended direction?

[tupelo-schneck]

It looks to me like #1066 literally just changes the behavior for an empty JSON object {} being the payload. I gave that example because it was the shortest example which demonstrated the issue; not because I actually cared about the empty JSON object being treated as content vs claims.

The issue here is that the payload of a content JWE could happen to have ANY JSON structure, and it should be recoverable as content even if it happens to have the structure of a non-empty JSON object.

Incidentally #1066 might introduce in principle a new issue where an JWE with empty claims object can no longer be parsed as a claims JWE. (I doubt anyone cares about that though.)

I suggest reopening this issue and reconsidering #1066.

[lhazlewood]

@tupelo-schneck my apologies, I misunderstood the issue, and I agree - we should reopen.

[lhazlewood]

I just reverted that commit 95d0022