http: add PemReader

http: add PemReader, update to latest JWT & JWS specs

MockHttpTransport: change buildRequest to public for ease of mocking

JsonWebToken: update to http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-06

JsonWebSignature: add verifySignature

SecurityTestUtils: add private/public key pairs

SecurityUtils: add verify & remove PEM reading methods

[peleyal, 2013-02-15 15:37:08]

https://codereview.appspot.com/7330045/diff/1011/clirr-ignored-differences.xml
File clirr-ignored-differences.xml (right):

https://codereview.appspot.com/7330045/diff/1011/clirr-ignored-differences.xm...
clirr-ignored-differences.xml:18: </difference>
remove </difference> here. error in building!

https://codereview.appspot.com/7330045/diff/1011/clirr-ignored-differences.xm...
clirr-ignored-differences.xml:68:
<className>com/google/api/client/repackaged/**</className>
end tag </difference> is missing!

https://codereview.appspot.com/7330045/diff/1011/findbugs-exclude.xml
File findbugs-exclude.xml (left):

https://codereview.appspot.com/7330045/diff/1011/findbugs-exclude.xml#oldcode78
findbugs-exclude.xml:78: <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
Remove the wrapping "And" section becuase it's empty now

https://codereview.appspot.com/7330045/diff/1011/google-http-client/src/main/...
File
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebSignature.java
(right):

https://codereview.appspot.com/7330045/diff/1011/google-http-client/src/main/...
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebSignature.java:333:
if ("RS256".equals(algorithm)) {
I prefer here the following if (which is more readable to me):

if (!"RS256".equals(algorithm)) {
  return false;
}

Signature signatureAlg  = SecurityUtils.getSha256WithRsaSignatureAlgorithm();
return SecurityUtils.verify(signatureAlg, publicKey, signatureBytes,
signedContentBytes);

And then you can remove the declaration of Signature in the first line

https://codereview.appspot.com/7330045/diff/1011/google-http-client/src/main/...
File
google-http-client/src/main/java/com/google/api/client/util/SecurityUtils.java
(left):

https://codereview.appspot.com/7330045/diff/1011/google-http-client/src/main/...
google-http-client/src/main/java/com/google/api/client/util/SecurityUtils.java:152:
public static byte[] readPrivateKeyFromPem(InputStream pemStream, String
charsetName)
Why not keeping it here and just call the PemReader.readFirstSectionAndClose?

[yanivi, 2013-02-15 16:32:26]

also added toString to JsonWebToken

https://codereview.appspot.com/7330045/diff/1011/clirr-ignored-differences.xml
File clirr-ignored-differences.xml (right):

https://codereview.appspot.com/7330045/diff/1011/clirr-ignored-differences.xm...
clirr-ignored-differences.xml:18: </difference>
On 2013/02/15 15:37:08, peleyal wrote:
> remove </difference> here. error in building!

Done.

https://codereview.appspot.com/7330045/diff/1011/clirr-ignored-differences.xm...
clirr-ignored-differences.xml:68:
<className>com/google/api/client/repackaged/**</className>
On 2013/02/15 15:37:08, peleyal wrote:
> end tag </difference> is missing!

Done.

https://codereview.appspot.com/7330045/diff/1011/findbugs-exclude.xml
File findbugs-exclude.xml (left):

https://codereview.appspot.com/7330045/diff/1011/findbugs-exclude.xml#oldcode78
findbugs-exclude.xml:78: <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
On 2013/02/15 15:37:08, peleyal wrote:
> Remove the wrapping "And" section becuase it's empty now

Done.

https://codereview.appspot.com/7330045/diff/1011/google-http-client/src/main/...
File
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebSignature.java
(right):

https://codereview.appspot.com/7330045/diff/1011/google-http-client/src/main/...
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebSignature.java:333:
if ("RS256".equals(algorithm)) {
On 2013/02/15 15:37:08, peleyal wrote:
> I prefer here the following if (which is more readable to me):
> 
> if (!"RS256".equals(algorithm)) {
>   return false;
> }
> 
> Signature signatureAlg  = SecurityUtils.getSha256WithRsaSignatureAlgorithm();
> return SecurityUtils.verify(signatureAlg, publicKey, signatureBytes,
> signedContentBytes);
> 
> And then you can remove the declaration of Signature in the first line

Right, but I intentionally wrote it like this with the intention that we will
add more signature algorithms in the future.

https://codereview.appspot.com/7330045/diff/1011/google-http-client/src/main/...
File
google-http-client/src/main/java/com/google/api/client/util/SecurityUtils.java
(left):

https://codereview.appspot.com/7330045/diff/1011/google-http-client/src/main/...
google-http-client/src/main/java/com/google/api/client/util/SecurityUtils.java:152:
public static byte[] readPrivateKeyFromPem(InputStream pemStream, String
charsetName)
On 2013/02/15 15:37:08, peleyal wrote:
> Why not keeping it here and just call the PemReader.readFirstSectionAndClose?

Because I'd rather keep all PEM file reading methods in PemReader.  Keep in mind
that we haven't yet released SecurityUtils so it is easy to move it around now.

[peleyal, 2013-02-15 17:32:29]

LGTM

https://codereview.appspot.com/7330045/diff/12002/findbugs-exclude.xml
File findbugs-exclude.xml (right):

https://codereview.appspot.com/7330045/diff/12002/findbugs-exclude.xml#newcode67
findbugs-exclude.xml:67: <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
I think that I had a mistake here.
I thought that if the bug doesn't have a class\package it won't be considered.
So I thought you may delete the all <And>...</And> clause.
You should return back the <And> clause.

[yanivi, 2013-02-15 17:43:10]

Updated to the latest specification for JsonWebToken

https://codereview.appspot.com/7330045/diff/12002/findbugs-exclude.xml
File findbugs-exclude.xml (right):

https://codereview.appspot.com/7330045/diff/12002/findbugs-exclude.xml#newcode67
findbugs-exclude.xml:67: <Bug pattern="EI_EXPOSE_REP,EI_EXPOSE_REP2"/>
On 2013/02/15 17:32:29, peleyal wrote:
> I think that I had a mistake here.
> I thought that if the bug doesn't have a class\package it won't be considered.
> So I thought you may delete the all <And>...</And> clause.
> You should return back the <And> clause. 

Done.

[peleyal, 2013-02-19 14:23:14]

LGTM

https://codereview.appspot.com/7330045/diff/32002/google-http-client/src/main...
File
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebToken.java
(right):

https://codereview.appspot.com/7330045/diff/32002/google-http-client/src/main...
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebToken.java:178:
* none.
I think it will be nice to mention that it was named "prn" before draft 06. 
It is not that important because that class exists from 1.14,
up to you

[yanivi, 2013-02-19 14:52:03]

https://codereview.appspot.com/7330045/diff/32002/google-http-client/src/main...
File
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebToken.java
(right):

https://codereview.appspot.com/7330045/diff/32002/google-http-client/src/main...
google-http-client/src/main/java/com/google/api/client/json/webtoken/JsonWebToken.java:178:
* none.
On 2013/02/19 14:23:14, peleyal wrote:
> I think it will be nice to mention that it was named "prn" before draft 06. 
> It is not that important because that class exists from 1.14,
> up to you

In this case I don't think it is necessary to document how the fields were
renamed, and I even think that saying that may actually be more confusing
because they are technically different JSON keys.