git.iko.soy/typeable/oauth2-proxy
on master help sign in
Updated dependency versions which include CVE fixes (#1276)

* switched to github.com/golang-jwt/jwt and updated golang.org/x/crypto to include CVE fixes * added #1276 to changelog Co-authored-by: Joshua Vécsei <git@vecsei.me>

commit896787365950a88067b23c668a6aa16706454ad1 authorJVecsei <j.vecsei@gmx.de> dateThu 29 Jul 2021, 18:45 (5 years ago) parenta35db2a
8 files changed+19−14
compare with master
unifiedsplit
CHANGELOG.md+1 go.mod+3−3 go.sum+10−6 pkg/middleware/jwt_session_test.go+1−1 pkg/validation/options.go+1−1 providers/logingov.go+1−1 providers/logingov_test.go+1−1 providers/provider_data_test.go+1−1
CHANGELOG.md+1
@@ -13,6 +13,7 @@
1313
1414## Changes since v7.1.3
1515
16+- [#1276](https://github.com/oauth2-proxy/oauth2-proxy/pull/1276) Update crypto and switched to new github.com/golang-jwt/jwt (@JVecsei)
1617- [#1264](https://github.com/oauth2-proxy/oauth2-proxy/pull/1264) Update go-oidc to v3 (@NickMeves)
1718- [#1233](https://github.com/oauth2-proxy/oauth2-proxy/pull/1233) Extend email-domain validation with sub-domain capability (@morarucostel)
1819- [#1060](https://github.com/oauth2-proxy/oauth2-proxy/pull/1060) Implement RewriteTarget to allow requests to be rewritten before proxying to upstream servers (@JoelSpeed)
go.mod+3−3
@@ -10,11 +10,11 @@ require (
1010 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869 // indirect
1111 github.com/bsm/redislock v0.7.0
1212 github.com/coreos/go-oidc/v3 v3.0.0
13− github.com/dgrijalva/jwt-go v3.2.0+incompatible
1413 github.com/frankban/quicktest v1.10.0 // indirect
1514 github.com/fsnotify/fsnotify v1.4.9
1615 github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32
1716 github.com/go-redis/redis/v8 v8.2.3
17+ github.com/golang-jwt/jwt v3.2.1+incompatible
1818 github.com/google/uuid v1.2.0
1919 github.com/gorilla/mux v1.8.0
2020 github.com/justinas/alice v1.2.0
@@ -30,8 +30,8 @@ require (
3030 github.com/stretchr/testify v1.6.1
3131 github.com/vmihailenco/msgpack/v4 v4.3.11
3232 github.com/yhat/wsutil v0.0.0-20170731153501-1d66fa95c997
33− golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a
34− golang.org/x/net v0.0.0-20200822124328-c89045814202
33+ golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97
34+ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110
3535 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
3636 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a
3737 google.golang.org/api v0.20.0
go.sum+10−6
@@ -81,7 +81,6 @@ github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7Do
8181github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
8282github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
8383github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
84−github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
8584github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
8685github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
8786github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
@@ -135,6 +134,8 @@ github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7a
135134github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
136135github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
137136github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
137+github.com/golang-jwt/jwt v3.2.1+incompatible h1:73Z+4BJcrTC+KczS6WvTPvRGOp1WmfEP4Q1lOd9Z/+c=
138+github.com/golang-jwt/jwt v3.2.1+incompatible/go.mod h1:8pz2t5EyA70fFQQSrl6XZXzqecmYZeUEB8OUGHkxJ+I=
138139github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
139140github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
140141github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -457,8 +458,8 @@ golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8U
457458golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
458459golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
459460golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
460−golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a h1:vclmkQCjlDX5OydZ9wv8rBCcS0QyQY66Mpf/7BZbInM=
461−golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
461+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97 h1:/UOmuWzQfxxo9UtlXMwuQU8CMgg1eZXqTRwkSQJWKOI=
462+golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
462463golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
463464golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
464465golang.org/x/exp v0.0.0-20200908183739-ae8ad444f925/go.mod h1:1phAWC201xIgDyaFpmDeZkgf70Q4Pd/CNqfRtVPtxNw=
@@ -501,8 +502,8 @@ golang.org/x/net v0.0.0-20200505041828-1ed23360d12c/go.mod h1:qpuaurCH72eLCgpAm/
501502golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
502503golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
503504golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
504−golang.org/x/net v0.0.0-20200822124328-c89045814202 h1:VvcQYSHwXgi7W+TpUR6A9g6Up98WAHf3f/ulnJ62IyA=
505−golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
505+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 h1:qWPm9rbaAMKs8Bq/9LRpbMqxWRVUAQwMI9fVrssnTfw=
506+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
506507golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
507508golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
508509golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -544,8 +545,11 @@ golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7w
544545golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
545546golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
546547golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
547−golang.org/x/sys v0.0.0-20201214210602-f9fddec55a1e h1:AyodaIpKjppX+cBfTASF2E1US3H2JFBj920Ot3rtDjs=
548+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
548549golang.org/x/sys v0.0.0-20201214210602-f9fddec55a1e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
550+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 h1:SrN+KX8Art/Sf4HNj6Zcz06G7VEz+7w9tdXTPOZ7+l4=
551+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
552+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
549553golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
550554golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
551555golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
pkg/middleware/jwt_session_test.go+1−1
@@ -14,7 +14,7 @@ import (
1414 "time"
1515
1616 "github.com/coreos/go-oidc/v3/oidc"
17− "github.com/dgrijalva/jwt-go"
17+ "github.com/golang-jwt/jwt"
1818 middlewareapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
1919 sessionsapi "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
2020 . "github.com/onsi/ginkgo"
pkg/validation/options.go+1−1
@@ -11,7 +11,7 @@ import (
1111 "strings"
1212
1313 "github.com/coreos/go-oidc/v3/oidc"
14− "github.com/dgrijalva/jwt-go"
14+ "github.com/golang-jwt/jwt"
1515 "github.com/mbland/hmacauth"
1616 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/options"
1717 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
providers/logingov.go+1−1
@@ -10,7 +10,7 @@ import (
1010 "net/url"
1111 "time"
1212
13− "github.com/dgrijalva/jwt-go"
13+ "github.com/golang-jwt/jwt"
1414 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
1515 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/requests"
1616 "gopkg.in/square/go-jose.v2"
providers/logingov_test.go+1−1
@@ -12,7 +12,7 @@ import (
1212 "testing"
1313 "time"
1414
15− "github.com/dgrijalva/jwt-go"
15+ "github.com/golang-jwt/jwt"
1616 . "github.com/onsi/gomega"
1717 "github.com/stretchr/testify/assert"
1818 "gopkg.in/square/go-jose.v2"
providers/provider_data_test.go+1−1
@@ -13,7 +13,7 @@ import (
1313 "time"
1414
1515 "github.com/coreos/go-oidc/v3/oidc"
16− "github.com/dgrijalva/jwt-go"
16+ "github.com/golang-jwt/jwt"
1717 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/sessions"
1818 "github.com/oauth2-proxy/oauth2-proxy/v7/pkg/encryption"
1919 . "github.com/onsi/gomega"