[cosmo0920]

Fixed both leaks in flb_oauth2_jwt.c:444. Duplicate JWT kid/alg and JWKS kid/n/e fields now fail before overwriting allocations. Allocation failures also clean up safely.

Added regression coverage. 33 integration cases and all three focused CTest targets passed, including valid-token recovery.

Commands run against the rebuilt binary:

ctest --test-dir build -R '^(flb-it-oauth2_jwt|flb-rt-in_http|flb-rt-in_opentelemetry)$' --output-on-failure

$env:FLUENT_BIT_BINARY = (Resolve-Path build/bin/fluent-bit.exe).Path
tests/integration/.venv/Scripts/python.exe -m pytest tests/integration/scenarios/in_http/tests/test_in_http_001.py tests/integration/scenarios/in_opentelemetry/tests/test_in_opentelemetry_001.py -k 'oauth2 and not http2' -q

Memory checker: not run—Valgrind and macOS Leaks are unavailable on this Windows host. Curl-based HTTP/2 cases were excluded because installed curl lacks HTTP/2 support; gRPC tests passed.

---

Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

• Example configuration file for the change
• Debug log output from testing the change

• Attached Valgrind output that shows no leaks or memory corruption was found

If this is a change to packaging of containers or native binaries then please confirm it works for all targets.

• Run local packaging test showing all targets (including any new ones) build.
• Set ok-package-test label to test for all targets (requires maintainer to do).

Documentation

• Documentation required for this feature

Backporting

• Backport to latest stable release.

---

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Summary by CodeRabbit

• Bug Fixes
  • JWT authentication now rejects tokens with duplicate kid or alg header fields, and JWKS keys with duplicate kid, n, or e fields. Fields with non-string values are also rejected.
  • Invalid tokens are denied before payloads are forwarded; valid-token behavior remains unchanged.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T04:52:20.012250Z	e80ab82	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c4552d7f-f8b8-4e45-8a28-3d3e3b4f7968

📥 Commits

Reviewing files that changed from the base of the PR and between b43b6a6 and e80ab82.

📒 Files selected for processing: 5

• src/flb_oauth2_jwt.c
• tests/integration/scenarios/in_http/tests/test_in_http_001.py
• tests/integration/scenarios/in_opentelemetry/tests/test_in_opentelemetry_001.py
• tests/integration/src/utils/oauth2.py
• tests/internal/oauth2_jwt.c

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 5 remain after this review.

📝 Walkthrough

The JWT header and JWKS key parsers now reject duplicate relevant fields and non-string values. Unit and integration tests cover malformed fields, HTTP and gRPC rejection, JWKS request behavior, and valid-token handling.

Changes: OAuth2 duplicate-field rejection

Layer / File(s)	Summary
JWT header validation src/flb_oauth2_jwt.c, tests/internal/oauth2_jwt.c	The header parser rejects duplicate kid and alg fields and non-string values. Unit tests cover escaped duplicates, invalid value types, and nested fields.
JWKS key validation src/flb_oauth2_jwt.c	The key parser rejects duplicate or non-string kid, n, and e fields. It also cleans up allocated values when parsing fails.
HTTP and gRPC integration coverage tests/integration/src/utils/oauth2.py, tests/integration/scenarios/in_http/tests/test_in_http_001.py, tests/integration/scenarios/in_opentelemetry/tests/test_in_opentelemetry_001.py	Helpers build duplicate JWT and JWKS members and track JWKS requests. Integration tests check rejection responses, absent forwarding or logs, and valid-token handling.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to e80ab

The change rejects duplicate or non-string JWT and JWKS members and fixes the related leaks. It adds unit and integration coverage, and no merge-blocking risk was identified.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 18 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the main change: mitigating memory leaks caused by duplicated JWT members. It is concise and specific.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}