Merge commit from fork (#2233)

bobcallaway · web-flow · commit 765a0e57608b · 2025-12-04T17:00:31.000Z
Fixes: GHSA-f83f-xpx7-ffpw Signed-off-by: Bob Callaway <bcallaway@google.com>
diff --git a/pkg/identity/issuerpool.go b/pkg/identity/issuerpool.go
@@ -41,11 +41,11 @@ func (p IssuerPool) Authenticate(ctx context.Context, token string, opts ...conf
 }
 
 func extractIssuerURL(token string) (string, error) {
-	parts := strings.Split(token, ".")
-	if len(parts) != 3 {
-		return "", fmt.Errorf("oidc: malformed jwt, expected 3 parts got %d", len(parts))
+	if strings.Count(token, ".") != 2 {
+		return "", fmt.Errorf("oidc: malformed jwt, token must have 3 parts")
 	}
 
+	parts := strings.SplitN(token, ".", 3)
 	raw, err := base64.RawURLEncoding.DecodeString(parts[1])
 	if err != nil {
 		return "", fmt.Errorf("oidc: malformed jwt payload: %w", err)

Original file line number	Diff line number	Diff line change
`@@ -41,11 +41,11 @@ func (p IssuerPool) Authenticate(ctx context.Context, token string, opts ...conf`
`41`	`41`	`}`
`42`	`42`
`43`	`43`	`func extractIssuerURL(token string) (string, error) {`
`44`		`- parts := strings.Split(token, ".")`
`45`		`- if len(parts) != 3 {`
`46`		`- return "", fmt.Errorf("oidc: malformed jwt, expected 3 parts got %d", len(parts))`
	`44`	`+ if strings.Count(token, ".") != 2 {`
	`45`	`+ return "", fmt.Errorf("oidc: malformed jwt, token must have 3 parts")`
`47`	`46`	`}`
`48`	`47`
	`48`	`+ parts := strings.SplitN(token, ".", 3)`
`49`	`49`	`raw, err := base64.RawURLEncoding.DecodeString(parts[1])`
`50`	`50`	`if err != nil {`
`51`	`51`	`return "", fmt.Errorf("oidc: malformed jwt payload: %w", err)`