Ensure numeric type of iat, nbf and exp parameters

Author: joshuaruesweg

src/JWT.php

@@ -142,24 +142,39 @@ public static function decode(
 
         // Check the nbf if it is defined. This is the time that the
         // token can actually be used. If it's not yet that time, abort.
-        if (isset($payload->nbf) && $payload->nbf > ($timestamp + static::$leeway)) {
-            throw new BeforeValidException(
-                'Cannot handle token prior to ' . \date(DateTime::ISO8601, $payload->nbf)
-            );
+        if (isset($payload->nbf)) {
+            if (!\is_int($payload->nbf)) {
+                throw new UnexpectedValueException('The property nbf must be of type integer.');
+            }
+            if ($payload->nbf > ($timestamp + static::$leeway)) {
+                throw new BeforeValidException(
+                    'Cannot handle token prior to ' . \date(DateTime::ISO8601, $payload->nbf)
+                );
+            }
         }
 
         // Check that this token has been created before 'now'. This prevents
         // using tokens that have been created for later use (and haven't
         // correctly used the nbf claim).
-        if (isset($payload->iat) && $payload->iat > ($timestamp + static::$leeway)) {
-            throw new BeforeValidException(
-                'Cannot handle token prior to ' . \date(DateTime::ISO8601, $payload->iat)
-            );
+        if (isset($payload->iat)) {
+            if (!\is_int($payload->iat)) {
+                throw new UnexpectedValueException('The property iat must be of type integer.');
+            }
+            if ($payload->iat > ($timestamp + static::$leeway)) {
+                throw new BeforeValidException(
+                    'Cannot handle token prior to ' . \date(DateTime::ISO8601, $payload->iat)
+                );
+            }
         }
 
         // Check if this token has expired.
-        if (isset($payload->exp) && ($timestamp - static::$leeway) >= $payload->exp) {
-            throw new ExpiredException('Expired token');
+        if (isset($payload->exp)) {
+            if (!\is_int($payload->exp)) {
+                throw new UnexpectedValueException('The property exp must be of type integer.');
+            }
+            if (($timestamp - static::$leeway) >= $payload->exp) {
+                throw new ExpiredException('Expired token');
+            }
         }
 
         return $payload;
@@ -194,6 +209,15 @@ public static function encode(
         if (isset($head) && \is_array($head)) {
             $header = \array_merge($head, $header);
         }
+        if (isset($payload['nbf']) && !\is_int($payload['nbf'])) {
+            throw new UnexpectedValueException('The property nbf must be an integer containing a unix timestamp.');
+        }
+        if (isset($payload['iat']) && !\is_int($payload['iat'])) {
+            throw new UnexpectedValueException('The property nbf must be an integer containing a unix timestamp.');
+        }
+        if (isset($payload['exp']) && !\is_int($payload['exp'])) {
+            throw new UnexpectedValueException('The property exp must be an integer containing a unix timestamp.');
+        }
         $segments = [];
         $segments[] = static::urlsafeB64Encode((string) static::jsonEncode($header));
         $segments[] = static::urlsafeB64Encode((string) static::jsonEncode($payload));