message: Add validation test with duplicated 'issuer' claim, and with invalid encoded claim name.
diff: @@ -380,6 +380,24 @@ class JwtTest(parameterized.TestCase):
  with self.assertRaises(tink.TinkError):
  jwt_mac.verify_mac_and_decode(token, val4)
  + @parameterized.parameters(SUPPORTED_LANGUAGES)
  + def test_duplicated_issuer(self, lang):
  + token = generate_token('{"alg":"HS256"}', '{"iss":"joe", "iss":"jane"}')
  + jwt_mac = testing_servers.jwt_mac(lang, KEYSET)
  +
  + if lang != 'java' and lang != 'python':
  + validator_with_second_issuer = jwt.new_validator(
  + ignore_issuer=True, allow_missing_expiration=True)
  + with self.assertRaises(tink.TinkError):
  + jwt_mac.verify_mac_and_decode(token, validator_with_second_issuer)
  + else:
  + # Currently, this is accepted in Java and Python, and always the last
  + # entry is used.
  + # TODO(b/241828611): This should be rejected.
  + validator_with_second_issuer = jwt.new_validator(
  + expected_issuer='jane', allow_missing_expiration=True)
  + jwt_mac.verify_mac_and_decode(token, validator_with_second_issuer)
  +
  @parameterized.parameters(SUPPORTED_LANGUAGES)
  def test_verify_empty_string_issuer(self, lang):
  token = generate_token('{"alg":"HS256"}', '{"iss":""}')
  @@ -438,6 +456,14 @@ class JwtTest(parameterized.TestCase):
  with self.assertRaises(tink.TinkError):
  jwt_mac.verify_mac_and_decode(token, EMPTY_VALIDATOR)
  + @parameterized.parameters(SUPPORTED_LANGUAGES)
  + def test_verify_with_invalid_json_escaped_utf16_in_claim_name(self, lang):
  + token = generate_token('{"alg":"HS256"}',
  + '{"\\uD800\\uD800claim":"value"}')
  + jwt_mac = testing_servers.jwt_mac(lang, KEYSET)
  + with self.assertRaises(tink.TinkError):
  + jwt_mac.verify_mac_and_decode(token, EMPTY_VALIDATOR)
  +
  @parameterized.parameters(SUPPORTED_LANGUAGES)
  def test_verify_audience(self, lang):
  token = generate_token('{"alg":"HS256"}', '{"aud":["joe", "jane"]}')
  