Downgrade jsonwebtoken version to 8.5.1 #297
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pull Request Description
In PR #132 , the Snyk bot suggested to update the jsonwebtoken module from 8.5.1 to 9.0.0.
Merging it was a bad decision.
JWT 9.0.0 has bugs, notably, it doesn't work when it's used in a browser. See:
sign
function throws error on frontend (in browser) auth0/node-jsonwebtoken#863The proposed fixes are to either downgrade the module to 8.5.1 or not to use it at all, as it's not supposed to be used outside of a server.
The reason why JWT was updated in fireblocks SDK in the first place is nonsensical. This is to fix a security issue, linked in the PR: https://security.snyk.io/vuln/SNYK-JS-JSONWEBTOKEN-3180022
This security issue mentions the possibility to bypass the signature process when giving a null private key for example.
This is not a problem, as the only usage of that module in the fireblocks sdk is to sign data before calling an API: https://github.com/search?q=repo%3Afireblocks%2Ffireblocks-sdk-js%20jsonwebtoken&type=code
Should the signature be bypassed, the API call just won't work, nothing more. No security issue here.
Choosing to update JWT on the other hand, that prevents using the SDK in a browser, which has many interesting use cases.
When trying to integrate, an exception is raised at the first API call:
No fix to this has been proposed by the JWT project. The only way to avoid it is to downgrade or use something else.
Therefore, I suggest rolling back this upgrade.
Type of change
How Has This Been Tested?
The bug was discovered when trying to use the code provided at https://developers.fireblocks.com/reference/evm-web3-provider
Downgrading the JWT package fixes the exception mentionned above.
Checklist: