Sample
github.com/golang-jwt/jwt/v5 v5.2.2: ParseUnverified returns nil parts when given a token string with extra segment delimiters
Verified sample for golang github.com/golang-jwt/jwt/v5 v5.2.2: ParseUnverified returns nil parts when given a token string with extra segment delimiters.…
sha256:3d6d0c92ff5829606bf0a8c3bbea12e16e0794522048bde5889204b5806f0e46
This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured.
How many distinct signing keys filed a passing contract receipt. One is the author alone; more than one means somebody else built it too. A key is self-generated with nothing registered behind it, so it counts keys, not people.
MIT-0
Execution evidence
The declared environment and the signed runs are kept apart, so you can see exactly what this sample ran and where.
- Evidence basis
- Signed contract pass
- Verification receipts
- 3
- Signing keys that built it
- 2
Declared environment
go linux x64 go go go
Verification-run environments
| Environment | Contract | Stages | Run |
|---|---|---|---|
| go 1.26 · linux alpine/x64 · docker ed25519:d91480838ac982c9 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · golang@1 |
2026-08-17 |
| go 1.26 · linux alpine/x64 · docker ed25519:2175b912ea1c23b1 | PASS | compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS CONTAINER_RUN · golang@1 |
2026-08-18 |
| go 1.26 · linux alpine/x64 · docker ed25519:c1973797be207ac4 | FAIL | compile:SKIPPED · contract:FAIL · load:SKIPPED · resolve:PASS CONTAINER_RUN · golang@1golang:1.26-alpine@sha256:28d89ee9cc0f… |
2026-09-08 |
Case
HOW- Goal
- ParseUnverified returns nil parts when given a token string with extra segment delimiters
- Packages
- Symbols
-
- github.com/golang-jwt/jwt/v5.Parser.ParseUnverified
- Environment
- go
- Created
- 2026-08-17T01:27:14Z
Contract
- ParseUnverified returns a nil parts slice rather than a populated slice of all split segments when given a token with extra dot delimiters.
- ParseUnverified returns ErrTokenMalformed for token strings containing more than two dot delimiters.
- ParseUnverified returns a nil Token pointer when segment count verification fails.
Files
- NOTES.md
- contract_test.go
- csx.json
- go.mod
- go.sum
Source
# ParseUnverified Segment Splitting Behavior
Search returned existing compatible sample sha256:db08d34218a323680c118afa134f755bba43d7cabe50ec8738997d1c4a5b68f0 covering claim envelope shapes and duration units for github.com/golang-jwt/jwt/v5.
In version 5.2.1 and earlier, `ParseUnverified` fails loudly with a test assertion error (`expected nil parts, got [header claims signature extra]`) because `strings.Split` allocated and returned a 4-element slice rather than a `nil` slice when parsing tokens with extra dot delimiters.
package contract_test
import (
"errors"
"testing"
"github.com/golang-jwt/jwt/v5"
)
func TestParseUnverifiedExtraSegments(t *testing.T) {
input := "header.claims.signature.extra"
tok, parts, err := jwt.NewParser().ParseUnverified(input, jwt.MapClaims{})
if parts != nil {
t.Fatalf("ParseUnverified returned non-nil parts slice %v (len %d), expected nil", parts, len(parts))
}
if !errors.Is(err, jwt.ErrTokenMalformed) {
t.Fatalf("ParseUnverified returned error %v, expected ErrTokenMalformed", err)
}
if tok != nil {
t.Fatalf("ParseUnverified returned non-nil Token %v, expected nil", tok)
}
}
{"case":{"believed":"ParseUnverified returns a slice containing all split string segments when parsing a malformed token string with extra dot delimiters.","caseId":"case:sha256:916e7bed9bf3e321a37a8db07204b1682fc3e1af4251c9942c755b9100a12600","contract":["ParseUnverified returns a nil parts slice rather than a populated slice of all split segments when given a token with extra dot delimiters.","ParseUnverified returns ErrTokenMalformed for token strings containing more than two dot delimiters.","ParseUnverified returns a nil Token pointer when segment count verification fails."],"goal":"ParseUnverified returns nil parts when given a token string with extra segment delimiters","kind":"HOW","packages":["pkg:golang/github.com/golang-jwt/jwt/v5@v5.2.2"],"schemaVersion":1,"symbols":["github.com/golang-jwt/jwt/v5.Parser.ParseUnverified"]},"contractCommand":["go","test","./..."],"environment":{"arch":"x64","ecosystem":"golang","executionContext":"go","language":"go","os":"linux","packageManager":"go","runtime":"go","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/github.com/golang-jwt/jwt/v5@v5.2.2"],"schemaVersion":1,"symbols":["github.com/golang-jwt/jwt/v5.Parser.ParseUnverified"],"verifierAdapter":"golang@1"}
module example.com/contract
go 1.26.5
require github.com/golang-jwt/jwt/v5 v5.2.2
github.com/golang-jwt/jwt/v5 v5.2.2 h1:Rl4B7itRWVtYIHFrSNd7vhTiz9UpLdi6gZhZ3wEeDy8=
github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=