diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon index 8452437b..09308c64 100644 --- a/phpstan-baseline.neon +++ b/phpstan-baseline.neon @@ -2045,16 +2045,6 @@ parameters: count: 1 path: src/Component/NestedToken/NestedTokenBuilder.php - - - message: "#^Parameter \\#2 \\$protectedHeader of method Jose\\\\Component\\\\Signature\\\\JWSBuilder\\:\\:addSignature\\(\\) expects array\\{alg\\?\\: string, string\\?\\: mixed\\}, array\\ given\\.$#" - count: 1 - path: src/Component/NestedToken/NestedTokenBuilder.php - - - - message: "#^Parameter \\#3 \\$header of method Jose\\\\Component\\\\Signature\\\\JWSBuilder\\:\\:addSignature\\(\\) expects array\\{alg\\?\\: string, string\\?\\: mixed\\}, array\\ given\\.$#" - count: 1 - path: src/Component/NestedToken/NestedTokenBuilder.php - - message: "#^Result of \\|\\| is always false\\.$#" count: 2 diff --git a/src/Component/Signature/JWSBuilder.php b/src/Component/Signature/JWSBuilder.php index b9b2c7a4..84201cc6 100644 --- a/src/Component/Signature/JWSBuilder.php +++ b/src/Component/Signature/JWSBuilder.php @@ -19,6 +19,7 @@ use function count; use function in_array; use function is_array; +use function is_string; class JWSBuilder { @@ -79,8 +80,8 @@ public function withPayload(string $payload, bool $isPayloadDetached = false): s /** * Adds the information needed to compute the signature. This method will return a new JWSBuilder object. * - * @param array{alg?: string, string?: mixed} $protectedHeader - * @param array{alg?: string, string?: mixed} $header + * @param array $protectedHeader + * @param array $header */ public function addSignature(JWK $signatureKey, array $protectedHeader, array $header = []): self { @@ -185,26 +186,25 @@ private function checkB64AndCriticalHeader(array $protectedHeader): void } /** - * @param array{alg?: string, string?: mixed} $protectedHeader - * @param array{alg?: string, string?: mixed} $header + * @param array $protectedHeader + * @param array $header * @return MacAlgorithm|SignatureAlgorithm */ private function findSignatureAlgorithm(JWK $key, array $protectedHeader, array $header): Algorithm { $completeHeader = [...$header, ...$protectedHeader]; - if (! array_key_exists('alg', $completeHeader)) { + $alg = $completeHeader['alg'] ?? null; + if (! is_string($alg)) { throw new InvalidArgumentException('No "alg" parameter set in the header.'); } - if ($key->has('alg') && $key->get('alg') !== $completeHeader['alg']) { - throw new InvalidArgumentException(sprintf( - 'The algorithm "%s" is not allowed with this key.', - $completeHeader['alg'] - )); + $keyAlg = $key->has('alg') ? $key->get('alg') : null; + if (is_string($keyAlg) && $keyAlg !== $alg) { + throw new InvalidArgumentException(sprintf('The algorithm "%s" is not allowed with this key.', $alg)); } - $algorithm = $this->signatureAlgorithmManager->get($completeHeader['alg']); + $algorithm = $this->signatureAlgorithmManager->get($alg); if (! $algorithm instanceof SignatureAlgorithm && ! $algorithm instanceof MacAlgorithm) { - throw new InvalidArgumentException(sprintf('The algorithm "%s" is not supported.', $completeHeader['alg'])); + throw new InvalidArgumentException(sprintf('The algorithm "%s" is not supported.', $alg)); } return $algorithm;