[Christinarlong]

Per VULN-2518

[sentry]

Bug: The new options parameter in jwt.decode can be used to pass {"verify_aud": False}, which bypasses audience verification even when an audience is specified.
_{Severity: MEDIUM}

Suggested Fix

The jwt.decode function should be modified to ensure its internal audience verification logic cannot be overridden by the options parameter. When an audience is provided, explicitly set decode_options["verify_aud"] = True. Alternatively, disallow the verify_aud key from being passed in the options dictionary.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/sentry/utils/jwt.py#L64-L65

Potential issue: The introduction of the `options` parameter to the
`sentry.utils.jwt.decode` function allows a caller to bypass audience verification. If a
caller passes `options={"verify_aud": False}` along with a specific `audience`
parameter, the `verify_aud` setting in `options` takes precedence within the underlying
`pyjwt.decode` call. This disables the audience check, creating a latent security
vulnerability. While no current production code exploits this pattern, it enables a
bypass that was not possible before this change and could be inadvertently used in the
future.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[michelletran-sentry]

Thoughts on making this option a default configuration in decode? The clanker tells me that there is only one place where exp is potentially missing (Jira Server Webhoks). Making this a default config would harden existing uses of decode and make it easier to do the right thing for any future uses of this method.

[getsantry]

This pull request has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you add the label WIP, I will leave it alone unless WIP is removed ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[getsantry]

This pull request has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you add the label WIP, I will leave it alone unless WIP is removed ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

perfecto