Skip to content

[LOW] Redact private JWK material from inspection - #754

Open
OskarEichler wants to merge 1 commit into
jwt:mainfrom
OskarEichler:codex/security-redact-jwk-inspection
Open

[LOW] Redact private JWK material from inspection#754
OskarEichler wants to merge 1 commit into
jwt:mainfrom
OskarEichler:codex/security-redact-jwk-inspection

Conversation

@OskarEichler

Copy link
Copy Markdown
Contributor

Summary

Prevents routine inspection and pretty-printing of JWK objects from exposing private cryptographic parameters. This addresses finding 4 in #723.

Problem

Ruby's default object inspection includes instance variables. JWT::JWK::KeyBase stores complete JWK parameters in @parameters, including:

  • HMAC secret k
  • RSA private values d, p, q, dp, dq, and qi
  • EC private value d

Logging, debugging, or pretty-printing a private JWK therefore emits private key material.

Fix

Implement inspect and pretty_print in KeyBase using each concrete JWK type's existing default export. That export already retains public metadata while omitting private cryptographic parameters.

Verification

  • Focused reproduction before: HMAC, RSA, and EC private values all appeared in both inspect and PP.pp
  • Focused reproduction after: all six checks report redacted
  • bundle exec rspec: 557 examples, 0 failures, 12 expected pending
  • bundle exec rubocop lib/jwt/jwk/key_base.rb: no offenses
  • Ruby syntax check: successful
  • Ruby 4.0.6, OpenSSL 3.6.0/3.6.3

No test files are included in this focused patch. The behavior was verified with an external reproduction plus the complete existing suite.

Compatibility

The textual representation of JWK objects changes. Public JWK parameters remain visible; private cryptographic parameters no longer do. No runtime signing, verification, import, or export API behavior changes. No breaking change intended.

@OskarEichler
OskarEichler force-pushed the codex/security-redact-jwk-inspection branch from 7d1d608 to fbb25d2 Compare September 4, 2026 16:33
Comment thread lib/jwt/jwk/key_base.rb
end

def pretty_print(pp)
pp.text(inspect)

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pp is not a dependency of the gem so i would drop this method.

Comment thread lib/jwt/jwk/key_base.rb
end

def inspect
"#<#{self.class} @parameters=#{export.inspect}>"

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A spec to test this would be useful. also maybe not claim @parameters equals the exported value as its not really true.

@anakinj

anakinj commented Sep 5, 2026

Copy link
Copy Markdown
Member

@OskarEichler This looks promising. Could you take a look at my comments and adjust?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants