CSCfi / CSCfi/rems

Update deprecated base64 function in `rems.jwt/show`

Open
#3,457 0 comments 0 reactions 0 assignees View on GitHub
Technical Debt
Dominant language
Clojure
Stars
66
Forks
28
Avg merge
7d 4h
Merged PRs (30d)
2

Description

`clj-kondo #'buddy.core.codecs.base64/decode is deprecated since 1.7.1 src/clj/rems/jwt.clj:62:13`

Change implementation to use the non-deprecated function, likely `b64->bytes` or the newer `b64->str` in the `buddy.core.codecs` namespace. Also, the inline function with `.getBytes` could possibly be replaced with `buddy.core.codecs/->bytes`. However, simply dropping in `b64->bytes` throws an exception "illegal base64 character `2e`", which is the dot (`.`) character, which likely comes from the earlier `clojure.string/split` using the third parameter `limit` (`2`). Apparently `buddy.core.codecs` uses a different Java library for base64 operations than `buddy.core.codecs.base64`, which seems to happily accept the dot. Removing the `limit` and instead taking the first two parts seems to do the trick. To paraphrase the test,

```clojure
(let [jwt "eyJhbGciOiJSUzI1NiIsImprdSI6Imh0dHA6Ly9sb2NhbGhvc3Q6MzAwMC9hcGkvandrIiwidHlwIjoiSldUIiwia2lkIjoiMjAxMS0wNC0yOSJ9.eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjMwMDAvIiwic3ViIjoiZWxpeGlyLXVzZXIiLCJpYXQiOjI1MjQ2MDgwMDAsImV4cCI6MjU1NjE0NDAwMCwiZ2E0Z2hfdmlzYV92MSI6eyJ0eXBlIjoiQ29udHJvbGxlZEFjY2Vzc0dyYW50cyIsInZhbHVlIjoiRUdBRDAwMDAxMDA2NjczIiwic291cmNlIjoiRUdBQzAwMDAxMDAwOTA4IiwiYnkiOiJkYWMiLCJhc3NlcnRlZCI6MTAzNDI5NDQwMH19.LnfsNxVfM_NfuxYYQtZexp975Hc3hrCxTG0fhMrgTakSLXa6gASc5MPn14seqsTjuyhtmUnu7WrCEVxko8WRvJybGDWmdbrycYafNg4amevtbs7hTPCkqAXD1DcuP53LDeLhSl_YrNgfz4aDE0uaw37I8TAsqdAeDALcZqQ6SIwF5wBG_wRWtKTPmDp-GTpzy9STx-nrIqw3SYeftunlI4wDs5avaktDuOpgMl8TVUGodGFjJsZjN8UOhKgSsGdXDGmu4FeeIjJt9Sa_dsCQPZQ1GpHyg1lFa63FZPPOy2-F9TNZcHJR1vFxKLD9U8Lvr11-EFjIiGuDg6miiWyodw"]
(= [{:alg "RS256"
:kid "2011-04-29"
:jku "http://localhost:3000/api/jwk"
:typ "JWT"}
{:sub "elixir-user"
:iss "http://localhost:3000/"
:exp 2556144000
:ga4gh_visa_v1 {:value "EGAD00001006673"
:type "ControlledAccessGrants"
:source "EGAC00001000908"
:asserted 1034294400
:by "dac"}
:iat 2524608000}]
(into []
(comp (take 2)
(map buddy.core.codecs/->bytes)
(map buddy.core.codecs/b64->str)
(map rems.json/parse-string))
(clojure.string/split jwt #"\."))))
;;=> true
```

Additionally, `buddy-core` is missing from `project.clj`, it's required by `buddy-sign` but it would be good to include it since we refer to it directly in `rems.jwt` and a couple of other namespaces as well.

https://funcool.github.io/buddy-core/latest/buddy.core.codecs.html

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.