mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-08-19 13:46:58 +00:00
chrislu
1c991d05c9
Updated github.com/golang-jwt/jwt/v5 from v5.0.0 to v5.3.0 to address excessive memory allocation vulnerability during header parsing. Changes: - Updated JWT library in test/s3/iam/go.mod from v5.0.0 to v5.3.0 - Added JWT library v5.3.0 to main go.mod - Fixed test compilation issues after stateless STS refactoring - Removed obsolete session store references from test files - Updated test method signatures to match stateless STS API Security Impact: - Fixes CVE allowing excessive memory allocation during JWT parsing - Hardens JWT token validation against potential DoS attacks - Ensures secure JWT handling in STS authentication flows Test Notes: - Some test failures are expected due to stateless JWT architecture - Session revocation tests now reflect stateless behavior (tokens expire naturally) - All compilation issues resolved, core functionality remains intact
17 lines
379 B
AMPL
17 lines
379 B
AMPL
module github.com/seaweedfs/seaweedfs/test/s3/iam
|
|
|
|
go 1.24
|
|
|
|
require (
|
|
github.com/aws/aws-sdk-go v1.44.0
|
|
github.com/golang-jwt/jwt/v5 v5.3.0
|
|
github.com/stretchr/testify v1.8.4
|
|
)
|
|
|
|
require (
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/jmespath/go-jmespath v0.4.0 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|