mapclaims: stop treating exp=0 as a missing claim (#509)

* mapclaims: stop treating exp=0 as a missing claim

MapClaims.parseNumericDate short-circuited and returned nil whenever a
float64 value happened to be 0. That made the very-much-set exp claim
"exp": 0 invisible to verifyExpiresAt, so the token was treated as
valid instead of expired.

The json.Number branch doesn't have the same carve-out, so parsing the
exact same token via WithJSONNumber() correctly came back as expired.
Drop the special case so both branches agree and an exp of 0 means
"this token expired at the unix epoch", which is what the JWT spec
calls for.

Fixes #496.

Signed-off-by: Charlie Tonneslan <cst0520@gmail.com>

* mapclaims: test that string exp comes back as ErrInvalidType

Pins down the corner case raised in review: empty-string exp must
surface as ErrInvalidType rather than slipping into the float64
branch and looking like a 0 (i.e. epoch) value.

Signed-off-by: Charlie Tonneslan <cst0520@gmail.com>

---------

Signed-off-by: Charlie Tonneslan <cst0520@gmail.com>

Author: c-tonneslan

map_claims.go

@@ -50,10 +50,6 @@ func (m MapClaims) parseNumericDate(key string) (*NumericDate, error) {
 
 	switch exp := v.(type) {
 	case float64:
-		if exp == 0 {
-			return nil, nil
-		}
-
 		return newNumericDateFromSeconds(exp), nil
 	case json.Number:
 		v, _ := exp.Float64()

map_claims_test.go

@@ -1,6 +1,8 @@
 package jwt
 
 import (
+	"encoding/json"
+	"errors"
 	"testing"
 	"time"
 )
@@ -192,3 +194,45 @@ func TestMapClaims_parseString(t *testing.T) {
 		})
 	}
 }
+
+// Regression for #496: a token whose exp claim is the literal 0 (i.e.
+// 1970-01-01) used to be treated as valid because parseNumericDate
+// special-cased a zero float64 as "claim not present". The json.Number
+// branch had no such carve-out, so the same token parsed via
+// WithJSONNumber() correctly came back expired.
+func TestMapClaims_GetExpirationTime_ZeroIsExpired(t *testing.T) {
+	for name, claims := range map[string]MapClaims{
+		"float64":     {"exp": float64(0)},
+		"json.Number": {"exp": json.Number("0")},
+	} {
+		t.Run(name, func(t *testing.T) {
+			err := NewValidator().Validate(claims)
+			if err == nil {
+				t.Fatalf("expected an error for exp=0, got nil")
+			}
+			if !errors.Is(err, ErrTokenExpired) {
+				t.Fatalf("expected ErrTokenExpired, got %v", err)
+			}
+		})
+	}
+}
+
+// A string exp must come back as ErrInvalidType, not as a stealth
+// "claim not present" via the old float64==0 shortcut. Empty string is
+// the case worth pinning down explicitly.
+func TestMapClaims_GetExpirationTime_StringIsInvalidType(t *testing.T) {
+	for name, claims := range map[string]MapClaims{
+		"empty string": {"exp": ""},
+		"non-empty":    {"exp": "foo"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			_, err := claims.GetExpirationTime()
+			if err == nil {
+				t.Fatalf("expected an error, got nil")
+			}
+			if !errors.Is(err, ErrInvalidType) {
+				t.Fatalf("expected ErrInvalidType, got %v", err)
+			}
+		})
+	}
+}