Merge pull request #318 from opentok/fix/security-upgrades

SecondeJK · web-flow · commit 8d2da2045f7e · 2022-11-09T12:03:02.000Z
fix: security bumps for composer firebase jwt and front end samples
diff --git a/composer.json b/composer.json
@@ -31,7 +31,7 @@
         "php": "^7.2|^8.0",
         "ext-xml": "*",
         "johnstevenson/json-works": "~1.1",
-        "firebase/php-jwt": "^5.0",
+        "firebase/php-jwt": "^6.0",
         "guzzlehttp/guzzle": "~6.0|~7.0",
       "ext-json": "*"
     },
diff --git a/sample/Archiving/templates/base.html b/sample/Archiving/templates/base.html
@@ -7,11 +7,11 @@
   <meta name="description" content="">
   <meta name="viewport" content="width=device-width">
 
-  <link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.0.0/css/bootstrap.min.css">
-  <link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.0.0/css/bootstrap-theme.min.css">
+  <link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.0.0/css/bootstrap.min.css">
+  <link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.0.0/css/bootstrap-theme.min.css">
   <link rel="stylesheet" href="css/sample.css">
 
-  <script type="text/javascript" src="//cdnjs.cloudflare.com/ajax/libs/jquery/1.10.2/jquery.min.js"></script>
+  <script type="text/javascript" src="//cdnjs.cloudflare.com/ajax/libs/jquery/3.5.0/jquery.min.js"></script>
 </head>
 <body>
 
@@ -24,6 +24,6 @@
 
   {% block content %}{% endblock %}
 
-  <script type="text/javascript" src="//cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.0.0/js/bootstrap.min.js"></script>
+  <script type="text/javascript" src="//cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.0.0/js/bootstrap.min.js"></script>
 </body>
 </html>
diff --git a/sample/SipCall/templates/index.php b/sample/SipCall/templates/index.php
@@ -5,7 +5,7 @@
     <link rel="stylesheet" href="//fonts.googleapis.com/css?family=Muli:300,300italic" type='text/css'>
     <link rel='stylesheet' href='/stylesheets/style.css' />
     <link rel='stylesheet' href='/stylesheets/pattern.css' />
-    <script src="https://code.jquery.com/jquery-3.1.0.min.js"></script>
+    <script src="https://code.jquery.com/jquery-3.5.0.min.js"></script>
     <script src="https://static.opentok.com/v2/js/opentok.min.js"></script>
     <script>
       var sessionId = "<?php echo $sessionId ?>";
diff --git a/src/OpenTok/Util/Client.php b/src/OpenTok/Util/Client.php
@@ -109,7 +109,7 @@ private function createAuthHeader()
             'exp' => time() + (5 * 60),
             'jti' => uniqid(),
         );
-        return JWT::encode($token, $this->apiSecret);
+        return JWT::encode($token, $this->apiSecret, 'HS256');
     }
 
     // General API Requests
diff --git a/tests/OpenTokTest/TestHelpers.php b/tests/OpenTokTest/TestHelpers.php
@@ -2,6 +2,7 @@
 
 namespace OpenTokTest;
 
+use Firebase\JWT\Key;
 use GuzzleHttp\Psr7\Response;
 use \Firebase\JWT\JWT;
 
@@ -40,7 +41,7 @@ public static function validateOpenTokAuthHeader($apiKey, $apiSecret, $token)
         }
 
         try {
-            $decodedToken = JWT::decode($token, $apiSecret, array('HS256'));
+            $decodedToken = JWT::decode($token, new Key($apiSecret, 'HS256'));
         } catch (\Exception $e) {
             return false;
         }

Original file line number	Diff line number	Diff line change
`@@ -109,7 +109,7 @@ private function createAuthHeader()`
`109`	`109`	`'exp' => time() + (5 * 60),`
`110`	`110`	`'jti' => uniqid(),`
`111`	`111`	`);`
`112`		`- return JWT::encode($token, $this->apiSecret);`
	`112`	`+ return JWT::encode($token, $this->apiSecret, 'HS256');`
`113`	`113`	`}`
`114`	`114`
`115`	`115`	`// General API Requests`
Original file line number	Diff line number	Diff line change
`@@ -2,6 +2,7 @@`
`2`	`2`
`3`	`3`	`namespace OpenTokTest;`
`4`	`4`
	`5`	`+use Firebase\JWT\Key;`
`5`	`6`	`use GuzzleHttp\Psr7\Response;`
`6`	`7`	`use \Firebase\JWT\JWT;`
`7`	`8`
`@@ -40,7 +41,7 @@ public static function validateOpenTokAuthHeader($apiKey, $apiSecret, $token)`
`40`	`41`	`}`
`41`	`42`
`42`	`43`	`try {`
`43`		`- $decodedToken = JWT::decode($token, $apiSecret, array('HS256'));`
	`44`	`+ $decodedToken = JWT::decode($token, new Key($apiSecret, 'HS256'));`
`44`	`45`	`} catch (\Exception $e) {`
`45`	`46`	`return false;`
`46`	`47`	`}`