ticarpi / jwt_tool

:snake: A toolkit for testing, tweaking and cracking JSON Web Tokens
GNU General Public License v3.0
5.46k stars 670 forks source link

TypeError: the JSON object must be str, bytes or bytearray, not OrderedDict #106

Closed JulianGR closed 7 months ago

JulianGR commented 7 months ago

Hi,

Similarly to https://github.com/ticarpi/jwt_tool/issues/21 , I get the following error when running the tool:

[+] resource_access = JSON object:
Traceback (most recent call last):
  File "C:\[redacted]\jwt_tool\jwt_tool.py", line 2034, in <module>
    rejigToken(headDict, paylDict, sig)
  File "C:\[redacted]\jwt_tool\jwt_tool.py", line 1292, in rejigToken
    comparestamps, expiredtoken = dissectPayl(paylDict)
                                  ^^^^^^^^^^^^^^^^^^^^^
  File "C:\[redacted]\jwt_tool\jwt_tool.py", line 1196, in dissectPayl
    if type(castInput(paylDict[claim][subclaim])) == str:
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\[redacted]\jwt_tool\jwt_tool.py", line 588, in castInput
    jsonInput = json.loads(newInput)
                ^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\[redacted]\AppData\Local\Programs\Python\Python312\Lib\json\__init__.py", line 339, in loads
    raise TypeError(f'the JSON object must be str, bytes or bytearray, '
TypeError: the JSON object must be str, bytes or bytearray, not OrderedDict

I cannot provide the full JWT token due to NDAs, but the part of the JWT that produces such behaviour is the following, in the body of the JWT:

...
    "typ": "Bearer",
    "session_state": "6db1xxxx34ab4",
    "allowed-origins": [
        "*"
    ],
    "realm_access": {
        "roles": [
            "admin_role",
            "xxxx"            
        ]
    },
    "resource_access": {
        "realm-management": {
            "roles": [
                "mxxxxers"
            ]
        },
        "account": {
            "roles": [
                "maxxxxunt",
                "mxxxxnks",
                "vxxxx"
            ]
        }
    },
    "scope": "email profile",
    "sid": "6dxxxxxxab4",
...

As you can see, the problematic value is resource_access, since the JWT contains

 "resource_access": {
        "realm-management": {            
        },
        "account": {            
        }
    },

* SOLUTION ***:

I've fixed the issue, similarly to https://github.com/ticarpi/jwt_tool/issues/21 , by changing, in line 588

from

jsonInput = json.loads(newInput)

to

jsonInput = json.dumps(newInput)

Perhaps the tool could already include this change =)