"""PoC: python-jose accepts a JWS with an unrecognized critical extension,

in violation of RFC 7515 §4.1.11.

Run: python3 findings/poc/F002-pyjose-poc.py

"""

import base64

import hashlib

import hmac

import json

import jose

from jose import jwt

print(f"python-jose version: {getattr(jose, '__version__', '3.3.0')}")

secret = "schism-secret"

header = {"alg": "HS256", "typ": "JWT", "crit": ["foobar"], "foobar": True}

claims = {"sub": "alice", "iat": 1700000000, "exp": 9999999999}

def b64u(b: bytes) -> str:

    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()

h = b64u(json.dumps(header, separators=(",", ":")).encode())

p = b64u(json.dumps(claims, separators=(",", ":")).encode())

sig = hmac.new(secret.encode(), f"{h}.{p}".encode(), hashlib.sha256).digest()

token = f"{h}.{p}.{b64u(sig)}"

print(f"token: {token}")

print(f"token header (decoded): {json.dumps(header)}")

try:

    decoded = jwt.decode(token, secret, algorithms=["HS256"])

    print(f"RESULT: ACCEPTED - {decoded}")

    print(

        "RFC 7515 §4.1.11 requires this token be REJECTED because the\n"

        "recipient (python-jose) does not understand the 'foobar' extension."

    )

except Exception as e:

    print(f"RESULT: REJECTED - {type(e).__name__}: {e}")