add region check

add unit test for alb-verifier.ts (reach 100% coverage)

src/alb-verifier.ts

@@ -213,8 +213,8 @@ export class AlbJwtVerifier<
   ): AlbJwtPayload {
     const { decomposedJwt, jwksUri, verifyProperties } =
       this.getVerifyParameters(jwt, properties);
-    this.verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties);
     try {
+      this.verifyDecomposedJwtSync(decomposedJwt, jwksUri, verifyProperties);
       validateAlbJwtFields(decomposedJwt.header, verifyProperties);
     } catch (err) {
       if (
@@ -242,8 +242,8 @@ export class AlbJwtVerifier<
   ): Promise<AlbJwtPayload> {
     const { decomposedJwt, jwksUri, verifyProperties } =
       this.getVerifyParameters(jwt, properties);
-    await this.verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties);
     try {
+      await this.verifyDecomposedJwt(decomposedJwt, jwksUri, verifyProperties);
       validateAlbJwtFields(decomposedJwt.header, verifyProperties);
     } catch (err) {
       if (
@@ -295,17 +295,22 @@ export function validateAlbJwtFields(
   }
 }
 
-function defaultJwksUri(albArn: string | string[] | null): string {
-  if (albArn === null) {
+export function defaultJwksUri(albArn: string | string[] | null): string {
+  if (!albArn) {
     throw new ParameterValidationError("ALB ARN cannot be null");
   }
+  const regionRegex = /^[a-z]{2}-[a-z]+-\d{1}$/;
 
   const extractRegion = (arn: string): string => {
     const arnParts = arn.split(":");
-    if (arnParts.length < 4) {
+    if (arnParts.length < 4 || arnParts[0] !== "arn" || arnParts[1] !== "aws" || arnParts[2] !== "elasticloadbalancing") {
       throw new ParameterValidationError(`Invalid load balancer ARN: ${arn}`);
     }
-    return arnParts[3];
+    const region = arnParts[3];
+    if (!regionRegex.test(region)) {
+      throw new ParameterValidationError(`Invalid AWS region in ARN: ${region}`);
+    }
+    return region;
   };
 
   if (Array.isArray(albArn)) {

tests/unit/alb-verifier.test.ts

@@ -7,7 +7,7 @@ import {
 } from "./test-util";
 import { decomposeUnverifiedJwt } from "../../src/jwt";
 import { JwksCache, Jwks } from "../../src/jwk";
-import { AlbJwtVerifier } from "../../src/alb-verifier";
+import { AlbJwtVerifier, defaultJwksUri } from "../../src/alb-verifier";
 import {
   ParameterValidationError,
   JwtInvalidClaimError,
@@ -327,6 +327,87 @@ describe("unit tests alb verifier", () => {
         ).toMatchObject({ hello: "world" });
       });
 
+      test("albArn null", () => {
+        const kid = keypair.jwk.kid;
+        const userPoolId = "us-east-1_123456";
+        const issuer = `https://cognito-idp.us-east-1.amazonaws.com/${userPoolId}`;
+        const albArn =
+          "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188";
+        const clientId = "my-client-id";
+        const exp = 4000000000; // nock and jest.useFakeTimers do not work well together. Used of a long expired date instead
+
+        const signedJwt = signJwt(
+          {
+            typ: "JWT",
+            kid,
+            alg: "ES256",
+            iss: issuer,
+            client: clientId,
+            signer: albArn,
+            exp,
+          },
+          {
+            hello: "world",
+            exp,
+            iss: issuer,
+          },
+          keypair.privateKey
+        );
+        const verifier = AlbJwtVerifier.create({
+          albArn: null,
+          issuer,
+          clientId,
+        });
+        verifier.cacheJwks(keypair.jwks);
+
+        expect.assertions(1);
+        expect(verifier.verifySync(signedJwt)).toMatchObject({
+          hello: "world",
+        });
+      });
+
+      test("albArn undefined", () => {
+        const kid = keypair.jwk.kid;
+        const userPoolId = "us-east-1_123456";
+        const issuer = `https://cognito-idp.us-east-1.amazonaws.com/${userPoolId}`;
+        const albArn =
+          "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188";
+        const clientId = "my-client-id";
+        const exp = 4000000000; // nock and jest.useFakeTimers do not work well together. Used of a long expired date instead
+
+        const signedJwt = signJwt(
+          {
+            typ: "JWT",
+            kid,
+            alg: "ES256",
+            iss: issuer,
+            client: clientId,
+            signer: albArn,
+            exp,
+          },
+          {
+            hello: "world",
+            exp,
+            iss: issuer,
+          },
+          keypair.privateKey
+        );
+        const verifier = AlbJwtVerifier.create({
+          albArn: undefined as unknown as null,
+          issuer,
+          clientId,
+        });
+        verifier.cacheJwks(keypair.jwks);
+
+        expect.assertions(2);
+        expect(() => verifier.verifySync(signedJwt)).toThrow(
+          "AlbArn must be provided or set to null explicitly"
+        );
+        expect(() => verifier.verifySync(signedJwt)).toThrow(
+          ParameterValidationError
+        );
+      });
+
       test("clientId null", async () => {
         const region = "us-east-1";
         const userPoolId = "us-east-1_123456";
@@ -894,4 +975,73 @@ describe("unit tests alb verifier", () => {
       });
     });
   });
+
+  describe("defaultJwksUri", () => {
+    test("happy flow with us-east-1 region", () => {
+      const albArn =
+        "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188";
+
+      expect(defaultJwksUri(albArn)).toBe("https://public-keys.auth.elb.us-east-1.amazonaws.com");
+    });
+
+    test("happy flow with eu-west-2 region", () => {
+      const albArn =
+        "arn:aws:elasticloadbalancing:eu-west-2:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188";
+
+      expect(defaultJwksUri(albArn)).toBe("https://public-keys.auth.elb.eu-west-2.amazonaws.com");
+    });
+
+    test("happy flow with multi ALB ARN", () => {
+      const albArns = [
+        "arn:aws:elasticloadbalancing:eu-west-2:123456789012:loadbalancer/app/my-load-balancer-1/50dc6c495c0c9188",
+        "arn:aws:elasticloadbalancing:eu-west-2:123456789012:loadbalancer/app/my-load-balancer-2/901e7c495c0c9188",
+      ]
+
+      expect(defaultJwksUri(albArns)).toBe("https://public-keys.auth.elb.eu-west-2.amazonaws.com");
+    });
+
+    test("invalid load balancer ARN - too short", () => {
+      const albArn =
+        "arn:aws:elasticloadbalancing";
+
+      expect(()=>defaultJwksUri(albArn)).toThrow(new ParameterValidationError(`Invalid load balancer ARN: arn:aws:elasticloadbalancing`));
+    });
+
+    test("invalid load balancer ARN - invalid region 1", () => {
+      const albArn =
+        "arn:aws:elasticloadbalancing:.:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188";
+
+      expect(()=>defaultJwksUri(albArn)).toThrow(new ParameterValidationError(`Invalid AWS region in ARN: .`));
+    });
+
+    test("invalid load balancer ARN - invalid region 2", () => {
+      const albArn =
+        "arn:aws:elasticloadbalancing:/:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188";
+
+      expect(()=>defaultJwksUri(albArn)).toThrow(new ParameterValidationError(`Invalid AWS region in ARN: /`));
+    });
+
+    test("invalid load balancer ARN - invalid region 3", () => {
+      const albArn =
+        "arn:aws:elasticloadbalancing:?:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188";
+
+      expect(()=>defaultJwksUri(albArn)).toThrow(new ParameterValidationError(`Invalid AWS region in ARN: ?`));
+    });
+
+    test("invalid load balancer ARN - invalid region 4", () => {
+      const albArn =
+        "arn:aws:elasticloadbalancing:=:123456789012:loadbalancer/app/my-load-balancer/50dc6c495c0c9188";
+
+      expect(()=>defaultJwksUri(albArn)).toThrow(new ParameterValidationError((`Invalid AWS region in ARN: =`)));
+    });
+
+    test("invalid load balancer ARN with multiple regions", () => {
+      const albArns = [
+        "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/my-load-balancer-1/50dc6c495c0c9188",
+        "arn:aws:elasticloadbalancing:eu-west-2:123456789012:loadbalancer/app/my-load-balancer-2/901e7c495c0c9188",
+      ]
+
+      expect(()=>defaultJwksUri(albArns)).toThrow(new ParameterValidationError("Multiple regions found in ALB ARNs"));
+    });
+  });
 });