Skip to content

Commit b68c05f

Browse files
Mokshit06devin-ai-integration[bot]
Mokshit06
and
devin-ai-integration[bot]
authored
feat: Add JWT string validator (#3893)
* feat: add JWT string validator - Add z.string().jwt() validator for checking JWT format - Add optional algorithm validation with z.string().jwt({ alg: string }) - Implement in both main and Deno versions - Add comprehensive test coverage - Use atob() for browser compatibility * fix: rename algorithm to alg --------- Co-authored-by: devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
1 parent c1dd537 commit b68c05f

File tree

6 files changed

+148
-0
lines changed

6 files changed

+148
-0
lines changed

Diff for: ‎deno/lib/ZodError.ts

+1
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ export type StringValidation =
105105
| "ip"
106106
| "cidr"
107107
| "base64"
108+
| "jwt"
108109
| "base64url"
109110
| { includes: string; position?: number }
110111
| { startsWith: string }

Diff for: ‎deno/lib/__tests__/string.test.ts

+38
Original file line numberDiff line numberDiff line change
@@ -247,6 +247,44 @@ for (const str of invalidBase64URLStrings) {
247247
});
248248
}
249249

250+
test("jwt validations", () => {
251+
const jwt = z.string().jwt();
252+
const jwtWithAlg = z.string().jwt({ alg: "HS256" });
253+
254+
// Valid JWTs
255+
const validHeader = Buffer.from(JSON.stringify({ typ: "JWT", alg: "HS256" })).toString('base64url');
256+
const validPayload = Buffer.from("{}").toString('base64url');
257+
const validSignature = "signature";
258+
const validJWT = `${validHeader}.${validPayload}.${validSignature}`;
259+
260+
expect(() => jwt.parse(validJWT)).not.toThrow();
261+
expect(() => jwtWithAlg.parse(validJWT)).not.toThrow();
262+
263+
// Invalid format
264+
expect(() => jwt.parse("invalid")).toThrow();
265+
expect(() => jwt.parse("invalid.invalid")).toThrow();
266+
expect(() => jwt.parse("invalid.invalid.invalid")).toThrow();
267+
268+
// Invalid header
269+
const invalidHeader = Buffer.from("{}").toString('base64url');
270+
const invalidHeaderJWT = `${invalidHeader}.${validPayload}.${validSignature}`;
271+
expect(() => jwt.parse(invalidHeaderJWT)).toThrow();
272+
273+
// Wrong algorithm
274+
const wrongAlgHeader = Buffer.from(JSON.stringify({ typ: "JWT", alg: "RS256" })).toString('base64url');
275+
const wrongAlgJWT = `${wrongAlgHeader}.${validPayload}.${validSignature}`;
276+
expect(() => jwtWithAlg.parse(wrongAlgJWT)).toThrow();
277+
278+
// Custom error message
279+
const customMsg = "Invalid JWT token";
280+
const jwtWithMsg = z.string().jwt({ message: customMsg });
281+
try {
282+
jwtWithMsg.parse("invalid");
283+
} catch (error) {
284+
expect((error as z.ZodError).issues[0].message).toBe(customMsg);
285+
}
286+
});
287+
250288
test("url validations", () => {
251289
const url = z.string().url();
252290
url.parse("http://google.com");

Diff for: ‎deno/lib/types.ts

+35
Original file line numberDiff line numberDiff line change
@@ -604,6 +604,7 @@ export type ZodStringCheck =
604604
| { kind: "trim"; message?: string }
605605
| { kind: "toLowerCase"; message?: string }
606606
| { kind: "toUpperCase"; message?: string }
607+
| { kind: "jwt"; alg?: string; message?: string }
607608
| {
608609
kind: "datetime";
609610
offset: boolean;
@@ -641,6 +642,7 @@ const ulidRegex = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
641642
const uuidRegex =
642643
/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i;
643644
const nanoidRegex = /^[a-z0-9_-]{21}$/i;
645+
const jwtRegex = /^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/;
644646
const durationRegex =
645647
/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
646648

@@ -739,6 +741,25 @@ function isValidIP(ip: string, version?: IpVersion) {
739741
return false;
740742
}
741743

744+
function isValidJWT(jwt: string, alg?: string): boolean {
745+
if (!jwtRegex.test(jwt)) return false;
746+
try {
747+
const [header] = jwt.split(".");
748+
// Convert base64url to base64
749+
const base64 = header
750+
.replace(/-/g, "+")
751+
.replace(/_/g, "/")
752+
.padEnd(header.length + ((4 - (header.length % 4)) % 4), "=");
753+
const decoded = JSON.parse(atob(base64));
754+
if (typeof decoded !== "object" || decoded === null) return false;
755+
if (!decoded.typ || !decoded.alg) return false;
756+
if (alg && decoded.alg !== alg) return false;
757+
return true;
758+
} catch {
759+
return false;
760+
}
761+
}
762+
742763
function isValidCidr(ip: string, version?: IpVersion) {
743764
if ((version === "v4" || !version) && ipv4CidrRegex.test(ip)) {
744765
return true;
@@ -1012,6 +1033,16 @@ export class ZodString extends ZodType<string, ZodStringDef, string> {
10121033
});
10131034
status.dirty();
10141035
}
1036+
} else if (check.kind === "jwt") {
1037+
if (!isValidJWT(input.data, check.alg)) {
1038+
ctx = this._getOrReturnCtx(input, ctx);
1039+
addIssueToContext(ctx, {
1040+
validation: "jwt",
1041+
code: ZodIssueCode.invalid_string,
1042+
message: check.message,
1043+
});
1044+
status.dirty();
1045+
}
10151046
} else if (check.kind === "cidr") {
10161047
if (!isValidCidr(input.data, check.version)) {
10171048
ctx = this._getOrReturnCtx(input, ctx);
@@ -1105,6 +1136,10 @@ export class ZodString extends ZodType<string, ZodStringDef, string> {
11051136
return this._addCheck({ kind: "base64url", ...errorUtil.errToObj(message) });
11061137
}
11071138

1139+
jwt(options?: { alg?: string; message?: string }) {
1140+
return this._addCheck({ kind: "jwt", ...errorUtil.errToObj(options) });
1141+
}
1142+
11081143
ip(options?: string | { version?: IpVersion; message?: string }) {
11091144
return this._addCheck({ kind: "ip", ...errorUtil.errToObj(options) });
11101145
}

Diff for: ‎src/ZodError.ts

+1
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ export type StringValidation =
105105
| "ip"
106106
| "cidr"
107107
| "base64"
108+
| "jwt"
108109
| "base64url"
109110
| { includes: string; position?: number }
110111
| { startsWith: string }

Diff for: ‎src/__tests__/string.test.ts

+38
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,44 @@ for (const str of invalidBase64URLStrings) {
246246
});
247247
}
248248

249+
test("jwt validations", () => {
250+
const jwt = z.string().jwt();
251+
const jwtWithAlg = z.string().jwt({ alg: "HS256" });
252+
253+
// Valid JWTs
254+
const validHeader = Buffer.from(JSON.stringify({ typ: "JWT", alg: "HS256" })).toString('base64url');
255+
const validPayload = Buffer.from("{}").toString('base64url');
256+
const validSignature = "signature";
257+
const validJWT = `${validHeader}.${validPayload}.${validSignature}`;
258+
259+
expect(() => jwt.parse(validJWT)).not.toThrow();
260+
expect(() => jwtWithAlg.parse(validJWT)).not.toThrow();
261+
262+
// Invalid format
263+
expect(() => jwt.parse("invalid")).toThrow();
264+
expect(() => jwt.parse("invalid.invalid")).toThrow();
265+
expect(() => jwt.parse("invalid.invalid.invalid")).toThrow();
266+
267+
// Invalid header
268+
const invalidHeader = Buffer.from("{}").toString('base64url');
269+
const invalidHeaderJWT = `${invalidHeader}.${validPayload}.${validSignature}`;
270+
expect(() => jwt.parse(invalidHeaderJWT)).toThrow();
271+
272+
// Wrong algorithm
273+
const wrongAlgHeader = Buffer.from(JSON.stringify({ typ: "JWT", alg: "RS256" })).toString('base64url');
274+
const wrongAlgJWT = `${wrongAlgHeader}.${validPayload}.${validSignature}`;
275+
expect(() => jwtWithAlg.parse(wrongAlgJWT)).toThrow();
276+
277+
// Custom error message
278+
const customMsg = "Invalid JWT token";
279+
const jwtWithMsg = z.string().jwt({ message: customMsg });
280+
try {
281+
jwtWithMsg.parse("invalid");
282+
} catch (error) {
283+
expect((error as z.ZodError).issues[0].message).toBe(customMsg);
284+
}
285+
});
286+
249287
test("url validations", () => {
250288
const url = z.string().url();
251289
url.parse("http://google.com");

Diff for: ‎src/types.ts

+35
Original file line numberDiff line numberDiff line change
@@ -604,6 +604,7 @@ export type ZodStringCheck =
604604
| { kind: "trim"; message?: string }
605605
| { kind: "toLowerCase"; message?: string }
606606
| { kind: "toUpperCase"; message?: string }
607+
| { kind: "jwt"; alg?: string; message?: string }
607608
| {
608609
kind: "datetime";
609610
offset: boolean;
@@ -641,6 +642,7 @@ const ulidRegex = /^[0-9A-HJKMNP-TV-Z]{26}$/i;
641642
const uuidRegex =
642643
/^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$/i;
643644
const nanoidRegex = /^[a-z0-9_-]{21}$/i;
645+
const jwtRegex = /^[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+\.[A-Za-z0-9-_]*$/;
644646
const durationRegex =
645647
/^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
646648

@@ -739,6 +741,25 @@ function isValidIP(ip: string, version?: IpVersion) {
739741
return false;
740742
}
741743

744+
function isValidJWT(jwt: string, alg?: string): boolean {
745+
if (!jwtRegex.test(jwt)) return false;
746+
try {
747+
const [header] = jwt.split(".");
748+
// Convert base64url to base64
749+
const base64 = header
750+
.replace(/-/g, "+")
751+
.replace(/_/g, "/")
752+
.padEnd(header.length + ((4 - (header.length % 4)) % 4), "=");
753+
const decoded = JSON.parse(atob(base64));
754+
if (typeof decoded !== "object" || decoded === null) return false;
755+
if (!decoded.typ || !decoded.alg) return false;
756+
if (alg && decoded.alg !== alg) return false;
757+
return true;
758+
} catch {
759+
return false;
760+
}
761+
}
762+
742763
function isValidCidr(ip: string, version?: IpVersion) {
743764
if ((version === "v4" || !version) && ipv4CidrRegex.test(ip)) {
744765
return true;
@@ -1012,6 +1033,16 @@ export class ZodString extends ZodType<string, ZodStringDef, string> {
10121033
});
10131034
status.dirty();
10141035
}
1036+
} else if (check.kind === "jwt") {
1037+
if (!isValidJWT(input.data, check.alg)) {
1038+
ctx = this._getOrReturnCtx(input, ctx);
1039+
addIssueToContext(ctx, {
1040+
validation: "jwt",
1041+
code: ZodIssueCode.invalid_string,
1042+
message: check.message,
1043+
});
1044+
status.dirty();
1045+
}
10151046
} else if (check.kind === "cidr") {
10161047
if (!isValidCidr(input.data, check.version)) {
10171048
ctx = this._getOrReturnCtx(input, ctx);
@@ -1105,6 +1136,10 @@ export class ZodString extends ZodType<string, ZodStringDef, string> {
11051136
return this._addCheck({ kind: "base64url", ...errorUtil.errToObj(message) });
11061137
}
11071138

1139+
jwt(options?: { alg?: string; message?: string }) {
1140+
return this._addCheck({ kind: "jwt", ...errorUtil.errToObj(options) });
1141+
}
1142+
11081143
ip(options?: string | { version?: IpVersion; message?: string }) {
11091144
return this._addCheck({ kind: "ip", ...errorUtil.errToObj(options) });
11101145
}

0 commit comments

Comments
 (0)