fix: return ErrInvalidType for an invalid aud claim type in MapClaims (#511)

Author: ultramcu

map_claims.go

@@ -77,6 +77,16 @@ func (m MapClaims) parseClaimsString(key string) (ClaimStrings, error) {
 			}
 			cs = append(cs, vs)
 		}
+	case nil:
+		// The claim is either absent or explicitly null. As the claim is
+		// optional, this is not an error and means "no value".
+		return nil, nil
+	default:
+		// Any other type (e.g. a number, boolean or object) is invalid, which
+		// is reported as an error to stay consistent with the other accessors
+		// such as parseString and parseNumericDate, as well as with the
+		// per-element type check performed on []any audiences above.
+		return nil, newError(fmt.Sprintf("%s is invalid", key), ErrInvalidType)
 	}
 
 	return cs, nil

map_claims_test.go

@@ -3,6 +3,7 @@ package jwt
 import (
 	"encoding/json"
 	"errors"
+	"reflect"
 	"testing"
 	"time"
 )
@@ -236,3 +237,39 @@ func TestMapClaims_GetExpirationTime_StringIsInvalidType(t *testing.T) {
 		})
 	}
 }
+
+func TestMapClaims_GetAudience(t *testing.T) {
+	tests := []struct {
+		name    string
+		m       MapClaims
+		want    ClaimStrings
+		wantErr error // nil means no error; otherwise errors.Is(err, wantErr)
+	}{
+		// aud is optional: absent or null means "no audience", not an error.
+		{name: "missing aud", m: MapClaims{}, want: nil, wantErr: nil},
+		{name: "null aud", m: MapClaims{"aud": nil}, want: nil, wantErr: nil},
+		// Valid shapes per RFC 7519: a single string or an array of strings.
+		{name: "string aud", m: MapClaims{"aud": "example.com"}, want: ClaimStrings{"example.com"}, wantErr: nil},
+		{name: "[]string aud", m: MapClaims{"aud": []string{"a", "b"}}, want: ClaimStrings{"a", "b"}, wantErr: nil},
+		{name: "[]any of strings aud", m: MapClaims{"aud": []any{"a", "b"}}, want: ClaimStrings{"a", "b"}, wantErr: nil},
+		// Invalid types must return ErrInvalidType, consistent with the other
+		// MapClaims accessors (iss/sub/exp/nbf/iat) and with the per-element
+		// check already performed on []any audiences.
+		{name: "[]any with non-string element", m: MapClaims{"aud": []any{"a", 5}}, want: nil, wantErr: ErrInvalidType},
+		{name: "wrong type: number", m: MapClaims{"aud": 123}, want: nil, wantErr: ErrInvalidType},
+		{name: "wrong type: bool", m: MapClaims{"aud": true}, want: nil, wantErr: ErrInvalidType},
+		{name: "wrong type: object", m: MapClaims{"aud": map[string]any{"x": 1}}, want: nil, wantErr: ErrInvalidType},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := tt.m.GetAudience()
+			if !errors.Is(err, tt.wantErr) {
+				t.Errorf("MapClaims.GetAudience() error = %v, want %v", err, tt.wantErr)
+				return
+			}
+			if tt.wantErr == nil && !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("MapClaims.GetAudience() = %#v, want %#v", got, tt.want)
+			}
+		})
+	}
+}