{"record":{"id":"cc45fb4289cecbba","repo":"apereo/cas","slug":"jwks-cannot-contain-expressions","errorCode":null,"errorMessage":"JWKS cannot contain expressions","messagePattern":"JWKS cannot contain expressions","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"critical","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/jwks/OidcJsonWebKeyStoreJacksonDeserializer.java","lineNumber":45,"sourceCode":"        });\n    }\n\n    private static void rejectSpringExpressions(final JsonNode node) {\n        if (node.isObject()) {\n            node.properties().forEach(entry -> {\n                rejectSpringExpression(entry.getKey());\n                rejectSpringExpressions(entry.getValue());\n            });\n        } else if (node.isArray()) {\n            node.values().forEach(OidcJsonWebKeyStoreJacksonDeserializer::rejectSpringExpressions);\n        } else if (node.isString()) {\n            rejectSpringExpression(node.asString());\n        }\n    }\n\n    private static void rejectSpringExpression(final String value) {\n        if (SpringExpressionLanguageValueResolver.getInstance().hasExpressionMarkers(value)) {\n            throw new IllegalArgumentException(\"JWKS cannot contain expressions\");\n        }\n    }\n}\n","sourceCodeStart":27,"sourceCodeEnd":49,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/jwks/OidcJsonWebKeyStoreJacksonDeserializer.java#L27-L49","documentation":"OidcJsonWebKeyStoreJacksonDeserializer rejects any JWKS JSON value containing Spring expression markers (e.g. #{...}) while deserializing the keystore. Because JWKS content may be written to storage and later resolved, embedding Spring EL would allow expression injection; CAS fails fast with this IllegalArgumentException. It is a security guard, not a format problem.","triggerScenarios":"Loading or storing a JWKS JSON document whose keys' string values (kty, n, e, kid, x5c entries, etc.) contain expression markers like '#{' resolved by SpringExpressionLanguageValueResolver.","commonSituations":"Administrators pasting template-style values into a JWKS file; YAML/properties templating leaking #{...} placeholders into the keystore; malicious JWKS payloads in multi-tenant setups.","solutions":["Remove any #{...} (or other Spring expression markers) from the JWKS JSON values.","Store literal base64url key material; resolve configuration placeholders before generating the JWKS.","Validate the JWKS file with a scan for '#{' before loading it into CAS.","Treat an occurrence as potential injection and audit where the JWKS came from."],"exampleFix":"// before\n{\"kty\":\"RSA\",\"kid\":\"#{keyId}\",\"n\":\"...\"}\n// after\n{\"kty\":\"RSA\",\"kid\":\"my-key-1\",\"n\":\"...\"}","handlingStrategy":"validation","validationCode":"if (jwksJson.contains(\"#{\") || jwksJson.contains(\"${\")) {\n    throw new IllegalArgumentException(\"JWKS contains expression markers\");\n}","typeGuard":null,"tryCatchPattern":"try { keystore.load(inputStream); } catch (IllegalArgumentException e) {\n    LOGGER.error(\"Rejected JWKS with expression content: {}\", e.getMessage());\n}","preventionTips":["Never paste configuration templates into JWKS files","Resolve placeholders in a pre-processing step before key generation","Lint JWKS files in CI for '#{'/'${' markers","Treat expression markers in JWKS as a security incident"],"tags":["oidc","jwks","expression-injection","security"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}