Allow usage of firebase/php-jwt 7

[mdumoulin]

Description

Allow usage of firebase/php-jwt 7: https://github.com/firebase/php-jwt/releases/tag/v7.0.0

[lucas-bertrand]

Hello !
Will the release containing this PR be out soon? I have security vulnerability scanning tools on my CI that are flagging this error. I have to disable them until the fix is released, which is not ideal for me.
Ref : GHSA-2x45-7fc3-mxwq
Thx

[mdnight]

Same issue for me. Looking forward to getting this released 🙏

[pwolanin]

+1 it's a bit silly they made a major version for that fix. We worked around with this in composer:
"7.0.2 as 6.12.2"

[jjcarrion]

Hi,

I faced the same issues with our CI, it would be great to get this in and create a new release. For now we are using the @pwolanin 's workaround , thanks!

Anyway, heads-up for firebase/php-jwt 7.x: v7 enforces minimum HMAC key lengths, so the current PHPUnit + Behat JWT fixtures (short secrets like "secret" and the old embedded tokens) fails with DomainException: Provided key is too short even though Matcher/JWT.php usage is fine.

composer phpunit                               
> vendor/bin/phpunit
PHPUnit 12.5.14 by Sebastian Bergmann and contributors.

Runtime:       PHP 8.3.7
Configuration: /srv/www/behat-api-extension-pr/phpunit.dist.xml

EEFF...........................................................  63 / 287 ( 21%)
.....................................E......................... 126 / 287 ( 43%)
............................................................... 189 / 287 ( 65%)
............................................................... 252 / 287 ( 87%)
...................................                             287 / 287 (100%)

Time: 00:00.072, Memory: 22.00 MB

There were 3 errors:

1) Imbo\BehatApiExtension\ArrayContainsComparator\Matcher\JWTTest::testCanMatchJwt#0 with data ('eyJhbGciOiJIUzI1NiIsInR5cCI6I...Fh7HgQ', 'my jwt', ['1234567890', 'John Doe', true], 'secret')
DomainException: Provided key is too short

/srv/www/behat-api-extension-pr/vendor/firebase/php-jwt/src/JWT.php:709
/srv/www/behat-api-extension-pr/vendor/firebase/php-jwt/src/JWT.php:380
/srv/www/behat-api-extension-pr/vendor/firebase/php-jwt/src/JWT.php:161
/srv/www/behat-api-extension-pr/src/ArrayContainsComparator/Matcher/JWT.php:75
/srv/www/behat-api-extension-pr/tests/ArrayContainsComparator/Matcher/JWTTest.php:72

2) Imbo\BehatApiExtension\ArrayContainsComparator\Matcher\JWTTest::testCanMatchJwt#1 with data ('eyJ0eXAiOiJKV1QiLCJhbGciOiJIU...GJTIlg', 'my other jwt', ['bar'], 'supersecret')
DomainException: Provided key is too short

/srv/www/behat-api-extension-pr/vendor/firebase/php-jwt/src/JWT.php:709
/srv/www/behat-api-extension-pr/vendor/firebase/php-jwt/src/JWT.php:380
/srv/www/behat-api-extension-pr/vendor/firebase/php-jwt/src/JWT.php:161
/srv/www/behat-api-extension-pr/src/ArrayContainsComparator/Matcher/JWT.php:75
/srv/www/behat-api-extension-pr/tests/ArrayContainsComparator/Matcher/JWTTest.php:72

3) Imbo\BehatApiExtension\ArrayContainsComparatorTest::testCanUseCustomFunctionMatcher@@jwt with data ('jwt', Imbo\BehatApiExtension\ArrayContainsComparator\Matcher\JWT Object (...), ['@jwt(my jwt)'], ['eyJhbGciOiJIUzI1NiIsInR5cCI6I...kCPMG4'])
Imbo\BehatApiExtension\Exception\ArrayContainsComparatorException: Function "jwt" failed with error message: "Provided key is too short".
...

...
ERRORS!
Tests: 287, Assertions: 746, Errors: 3, Failures: 2.

I didn't want to create another PR fixing the tests, so I have added a patch here: https://gist.github.com/jjcarrion/ca91c6899c390acc3ef2b39f9e289cc9

Happy for maintainers to fold this into another PR or use it.

[pwolanin]

@jjcarrion maybe you should open a new PR that contains the version bump + test changes in one?

[christeredvartsen]

Fixed in 9377a63, will create a new release today.

[jjcarrion]

@jjcarrion maybe you should open a new PR that contains the version bump + test changes in one?

I missed this until today, sorry :(

Happy you will create a new release!

[christeredvartsen]

New release (v6.1.0) should be out now.