fix(jose): add max size for JWE zip=DEF decompression by lepture · Pull Request #830 · authlib/authlib

Expand Up @@ -3,20 +3,31 @@ from ..rfc7516 import JsonWebEncryption from ..rfc7516 import JWEZipAlgorithm
GZIP_HEAD = bytes([120, 156]) MAX_SIZE = 250 * 1024

class DeflateZipAlgorithm(JWEZipAlgorithm): name = "DEF" description = "DEFLATE"
def compress(self, s): def compress(self, s: bytes) -> bytes: """Compress bytes data with DEFLATE algorithm.""" data = zlib.compress(s) # drop gzip headers and tail # https://datatracker.ietf.org/doc/html/rfc1951 # since DEF is always gzip, we can drop gzip headers and tail return data[2:-4]
def decompress(self, s): def decompress(self, s: bytes) -> bytes: """Decompress DEFLATE bytes data.""" return zlib.decompress(s, -zlib.MAX_WBITS) if s.startswith(GZIP_HEAD): decompressor = zlib.decompressobj()

Check warning on line 24 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (3.12)

Missing Coverage

Line 24 missing coverage

Check warning on line 24 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (3.9)

Missing Coverage

Line 24 missing coverage

Check warning on line 24 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (3.13)

Missing Coverage

Line 24 missing coverage

Check warning on line 24 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (3.10)

Missing Coverage

Line 24 missing coverage

Check warning on line 24 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (pypy@3.9)

Missing Coverage

Line 24 missing coverage

Check warning on line 24 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (pypy@3.10)

Missing Coverage

Line 24 missing coverage

Check warning on line 24 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (3.11)

Missing Coverage

Line 24 missing coverage

else: decompressor = zlib.decompressobj(-zlib.MAX_WBITS) value = decompressor.decompress(s, MAX_SIZE) if decompressor.unconsumed_tail: raise ValueError(f"Decompressed string exceeds {MAX_SIZE} bytes")

Check warning on line 29 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (3.12)

Missing Coverage

Line 29 missing coverage

Check warning on line 29 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (3.9)

Missing Coverage

Line 29 missing coverage

Check warning on line 29 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (3.13)

Missing Coverage

Line 29 missing coverage

Check warning on line 29 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (3.10)

Missing Coverage

Line 29 missing coverage

Check warning on line 29 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (pypy@3.9)

Missing Coverage

Line 29 missing coverage

Check warning on line 29 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (pypy@3.10)

Missing Coverage

Line 29 missing coverage

Check warning on line 29 in authlib/jose/rfc7518/jwe_zips.py

View workflow job for this annotation

GitHub Actions / build (3.11)

Missing Coverage

Line 29 missing coverage

return value

def register_jwe_rfc7518(): Expand Down