sop/jwx

A PHP library for JSON web tokens (JWT) with signature (JWS) and encryption (JWE) support.

jwx's Issues

Declaration of JWK X509CertificateChainParameter's constructor must be compatible with JWX ArrayParameterValue's constructor

Hi there, thanks for the great package!

Trying to instantiate a JWK X509CertificateChainParameter throws the following error on PHP v8.0.10:

Declaration of Sop\JWX\JWK\Parameter\X509CertificateChainParameter::__construct(string ...$certs) must be compatible with Sop\JWX\Parameter\Feature\ArrayParameterValue::__construct(...$values)

I wonder if the X509 parameter's constructor definition can be changed to something like:

/**
 * Constructor.
 *
 * @param string[] $certs Base64 encoded DER certificates
 */
public function __construct(...$certs)
{
    /** @var string $cert */
    foreach ($certs as $cert) {
        if (!Base64::isValid($cert)) {
            throw new \UnexpectedValueException(
                'Certificate must be base64 encoded.');
        }
    }
    parent::__construct(self::PARAM_X509_CERTIFICATE_CHAIN, $certs);
}

Happy to open a PR with the change :)

Reporting a vulnerability

Hi,

I discovered a vulnerability in JWX that I would like to report. However, I can't seem to find an appropriate (private) channel to contact the maintainer for responsible disclosure.

@sop How would you like to receive this report?