ticarpi / jwt_tool

:snake: A toolkit for testing, tweaking and cracking JSON Web Tokens
GNU General Public License v3.0
5.46k stars 670 forks source link

URL Encoding of JWKS URL Fails Parsing #59

Open peniswafflexd opened 2 years ago

peniswafflexd commented 2 years ago

Expected Behavior

The JWKS URL (specified with -ju) should be able to handle % encoded URL characters.

Current Behavior

A parsing error happens when a % encoded URL character is found during parsing.

Possible Solution/Implementation

It looks like pythons configParser libary attempts to interpolate anything with a % sign preceding it, possibly replace all single % signs with a double % sign (%%) as this should escape the configParser trying to interpolate the string.

image

Steps to Reproduce

  1. ./jwt_tool.py -X s -ju http://notarealsite.net/?value=test%20 eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpbiI6InRpY2FycGkifQ.bsSwqj2c2uI9n7-ajmi3ixVGhPUiY7jO9SUn9dm15Po
  2. observe parsing error image

In the meantime, I might just write a small script that uses regex to replace single % with double %% before passing it through to the tool.