Raise JWTClaimsError for non-numeric exp/iat/nbf claims

jose/jwt.py

@@ -267,7 +267,7 @@ def _validate_iat(claims):
 
     try:
         int(claims["iat"])
-    except ValueError:
+    except (ValueError, TypeError, OverflowError):
         raise JWTClaimsError("Issued At claim (iat) must be an integer.")
 
 
@@ -292,7 +292,7 @@ def _validate_nbf(claims, leeway=0):
 
     try:
         nbf = int(claims["nbf"])
-    except ValueError:
+    except (ValueError, TypeError, OverflowError):
         raise JWTClaimsError("Not Before claim (nbf) must be an integer.")
 
     now = timegm(datetime.now(UTC).utctimetuple())
@@ -322,7 +322,7 @@ def _validate_exp(claims, leeway=0):
 
     try:
         exp = int(claims["exp"])
-    except ValueError:
+    except (ValueError, TypeError, OverflowError):
         raise JWTClaimsError("Expiration Time claim (exp) must be an integer.")
 
     now = timegm(datetime.now(UTC).utctimetuple())

tests/test_jwt.py

@@ -12,7 +12,7 @@
 import pytest
 
 from jose import jws, jwt
-from jose.exceptions import JWTError
+from jose.exceptions import JWTClaimsError, JWTError
 
 
 @pytest.fixture
@@ -531,3 +531,19 @@ def test_require(self, claims, key, claim, value):
         new_claims[claim] = value
         token = jwt.encode(new_claims, key)
         jwt.decode(token, key, options=options, audience=str(value))
+
+
+class TestTimeClaimTypeErrors:
+    """Non-numeric time claims must raise JWTClaimsError (#420)."""
+
+    @pytest.mark.parametrize("claim", ["exp", "iat", "nbf"])
+    @pytest.mark.parametrize(
+        "bad",
+        [float("inf"), float("-inf"), 1e999, [1, 2], {"x": 1}],
+    )
+    def test_non_integer_time_claim_raises_jwt_claims_error(self, claim, bad):
+        from jose.jwt import _validate_exp, _validate_iat, _validate_nbf
+
+        validators = {"exp": _validate_exp, "iat": _validate_iat, "nbf": _validate_nbf}
+        with pytest.raises(JWTClaimsError):
+            validators[claim]({claim: bad})