SOLIDPOD: jose vulnerable to untrusted JWK header keys

[jesscmoore]

Describe the Bug

Last week, this vulnerability was published and fixed in jose:
"A vulnerability in jose versions up to and including 0.3.5 could allow an unauthenticated, remote attacker to forge valid JWS/JWT tokens by using a key embedded in the JOSE header (jwk)

....

Patches
Upgrade to 0.3.5+1 or later.

Workarounds
Reject tokens where header jwk is present unless that jwk matches a key already present in the application's trusted key store."

See GHSA-vm9r-h74p-hg97

gl
flutter pub get
...
 jose 0.3.5 (affected by advisory: [^0], 0.3.5+2 available)
...

Success criteria

• Update all repos using <= jose 0.3.5 (solidpod, maybe others...)
• Published updated repos to pubdev

[Add any other context about the problem here.]

App Version: solidpod 0.12.2

Closing Criteria

Checklist for closing the issue:

• No errors from make prep
• All tests pass make qtest
• All repos with jose are checked and updated.

[jesscmoore]

flutter pub deps shows that it is solidpod's import of solid_auth that is the source of jose > adding a matching issue to solid_auth to update their first, then update solidpod. anusii/solid_auth#37

flutter pub deps
Dart SDK 3.11.4
Flutter SDK 3.41.6
solidpod 0.12.2
...
├── solid_auth 0.1.28
...
│   ├── jose 0.3.5
...

Check of my pub cache, shows an old version:

cd ~/.pub-cache/hosted/pub.dartlang.org
ll |grep jose
drwxr-xr-x@  11 u9904893  1942054467    352 10 Feb  2023 jose-0.3.3

[jesscmoore]

Given the above, after update in solid_auth, we should probably publish updates to solid_auth and solidpod, to update our published packages to use of patched jose.

[jesscmoore]

Unassigned myself, as this can be done by whoever reviews and publishes solid_auth