Ruben FiszelandClaude Opus 4.8 51776ef87c fix: refuse a private PEM as a guest verification key; fix stale log ...

jsonwebtoken 8.3's from_rsa_pem accepts private encodings (PKCS#1, PKCS#8), so
a pasted private key would be stored and then served back through the settings
response. Refuse any private PEM in decoding_key_from_pem, the single choke
point for both the save endpoint and per-request verification.

Also drop the last "canonical" references the is_scope_literal_path switch left
in the JWT arm: the refusal log no longer misdiagnoses a reserved character as a
malformed path, and the relocated guest_session_scopes doc carries the
sentinel/label distinction for both its callers.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-04 09:54:05 +02:00

..

src

fix: refuse a private PEM as a guest verification key; fix stale log

2026-09-04 09:54:05 +02:00

Cargo.toml

refactor: extract windmill-api into subcrates for parallel compilation (#7845)

2026-02-07 22:12:55 +00:00