Repository: mpdavis/python-jose

Issue:
Various issues in jwt.decode / jws._get_keys
I've had a couple issues (figuring out how to use jwt.decode) which stem from the jws._get_keys implementation.

1. key argument must be iterable- raises exception otherwise
2. string key argument must not contain 'keys' (ie if a PEM base64 segment or HS secret segment contains keys, it'll break)
3. key can't be the result of calling jwk.construct (usability issue)
4. attempting json.loads on anything not a string seems weird




Discussion:

Patch:
diff --git a/jose/jws.py b/jose/jws.py
index 293b32a..f1b1d1a 100644
--- a/jose/jws.py
+++ b/jose/jws.py
@@ -225,7 +225,7 @@ def _sig_matches_keys(keys, signing_input, signature, alg):
 def _get_keys(key):
 
     try:
-        key = json.loads(key)
+        key = json.loads(key, parse_int=str, parse_float=str)
     except Exception:
         pass
 


Test patch:
diff --git a/tests/test_jwt.py b/tests/test_jwt.py
index 03f5c28..0c599ca 100644
--- a/tests/test_jwt.py
+++ b/tests/test_jwt.py
@@ -52,6 +52,13 @@ class TestJWT:
                 key=key,
                 algorithms=[])
 
+    @pytest.mark.parametrize("key, token",
+                             [('1234567890', u'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoidGVzdCJ9.aNBlulVhiYSCzvsh1rTzXZC2eWJmNrMBjINT-0wQz4k'),
+                              ('123456789.0',u'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoidGVzdCJ9.D8WLFPMi3yKgua2jm3BKThFsParXpgxhIbsUc39zJDw')])
+    def test_numeric_key(self, key, token):
+        token_info = jwt.decode(token, key)
+        assert token_info == {"name": "test"}
+
     def test_invalid_claims_json(self):
         old_jws_verify = jws.verify
         try: