[cxf] branch 3.3.x-fixes updated: CXF-8231 - JAX-RS JOSE can't decrypt ECDHAESKeywrap

[coheigea]

This is an automated email from the ASF dual-hosted git repository.

coheigea pushed a commit to branch 3.3.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf.git


The following commit(s) were added to refs/heads/3.3.x-fixes by this push:
     new ed8398d  CXF-8231 - JAX-RS JOSE can't decrypt ECDHAESKeywrap
ed8398d is described below

commit ed8398d2ad151e308e379d1b375440a78a3aed47
Author: Colm O hEigeartaigh <cohei...@apache.org>
AuthorDate: Thu Mar 5 14:13:28 2020 +0000

    CXF-8231 - JAX-RS JOSE can't decrypt ECDHAESKeywrap
    
    (cherry picked from commit 92ff50f3ef36aea6ba63dba127490ea385ca3bbc)
---
 .../security/jose/jwe/EcdhAesWrapKeyDecryptionAlgorithm.java   |  4 ++--
 .../cxf/rs/security/jose/jwa/JwaDecryptRfcConformanceTest.java | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git 
a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/EcdhAesWrapKeyDecryptionAlgorithm.java
 
b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/EcdhAesWrapKeyDecryptionAlgorithm.java
index 687dc2d..fa0989b 100644
--- 
a/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/EcdhAesWrapKeyDecryptionAlgorithm.java
+++ 
b/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwe/EcdhAesWrapKeyDecryptionAlgorithm.java
@@ -35,13 +35,13 @@ public class EcdhAesWrapKeyDecryptionAlgorithm implements 
KeyDecryptionProvider
     }
     public EcdhAesWrapKeyDecryptionAlgorithm(ECPrivateKey key, KeyAlgorithm 
algo) {
         this.key = key;
-        this.algo = algo;
+        this.algo = algo != null ? algo : KeyAlgorithm.ECDH_ES_A128KW;
     }
     @Override
     public byte[] getDecryptedContentEncryptionKey(JweDecryptionInput 
jweDecryptionInput) {
         byte[] derivedKey = getDecryptedContentEncryptionKeyFromHeaders(
                 jweDecryptionInput.getJweHeaders(), key);
-        KeyDecryptionProvider aesWrap = new 
AesWrapKeyDecryptionAlgorithm(derivedKey, KeyAlgorithm.ECDH_ES_A128KW) {
+        KeyDecryptionProvider aesWrap = new 
AesWrapKeyDecryptionAlgorithm(derivedKey, algo) {
             protected boolean isValidAlgorithmFamily(String wrapAlgo) {
                 return AlgorithmUtils.isEcdhEsWrap(wrapAlgo);
             }
diff --git 
a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaDecryptRfcConformanceTest.java
 
b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaDecryptRfcConformanceTest.java
index 2a3f69d..49a150a 100644
--- 
a/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaDecryptRfcConformanceTest.java
+++ 
b/rt/rs/security/jose-parent/jose/src/test/java/org/apache/cxf/rs/security/jose/jwa/JwaDecryptRfcConformanceTest.java
@@ -142,4 +142,14 @@ public abstract class JwaDecryptRfcConformanceTest extends 
AbstractDecryptTest {
         test("/jwe/oct.128.a128kw.a128cbc-hs256.json.jwe");
     }
 
+    @Test
+    public void testEcdhA256wA128GcmJweJson() throws Exception {
+        test("/jwe/ec.p-256.ecdh-es+a256kw.a128gcm.json.jwe");
+    }
+
+    @Test
+    public void testEcdhA256KwA128CbcJweHs256() throws Exception {
+        test("/jwe/ec.p-256.ecdh-es+a256kw.a128cbc-hs256.json.jwe");
+    }
+
 }