85 строки
3.1 KiB
Diff
85 строки
3.1 KiB
Diff
From 0dd4dd541c665fb292d664f77604ba694726f298 Mon Sep 17 00:00:00 2001
|
|
From: Jacob Hoffman-Andrews <github@hoffman-andrews.com>
|
|
Date: Thu, 7 Mar 2024 14:25:21 -0800
|
|
Subject: [PATCH] v2: backport decompression limit fix (#109)
|
|
|
|
Backport from #107.
|
|
---
|
|
|
|
diff --git a/vendor/gopkg.in/square/go-jose.v2/crypter.go b/vendor/gopkg.in/square/go-jose.v2/crypter.go
|
|
index 73aab0f..0ae2e5e 100644
|
|
--- a/vendor/gopkg.in/square/go-jose.v2/crypter.go
|
|
+++ b/vendor/gopkg.in/square/go-jose.v2/crypter.go
|
|
@@ -406,6 +406,9 @@ func (ctx *genericEncrypter) Options() EncrypterOptions {
|
|
// Decrypt and validate the object and return the plaintext. Note that this
|
|
// function does not support multi-recipient, if you desire multi-recipient
|
|
// decryption use DecryptMulti instead.
|
|
+//
|
|
+// Automatically decompresses plaintext, but returns an error if the decompressed
|
|
+// data would be >250kB or >10x the size of the compressed data, whichever is larger.
|
|
func (obj JSONWebEncryption) Decrypt(decryptionKey interface{}) ([]byte, error) {
|
|
headers := obj.mergedHeaders(nil)
|
|
|
|
@@ -470,6 +473,9 @@ func (obj JSONWebEncryption) Decrypt(decryptionKey interface{}) ([]byte, error)
|
|
// with support for multiple recipients. It returns the index of the recipient
|
|
// for which the decryption was successful, the merged headers for that recipient,
|
|
// and the plaintext.
|
|
+//
|
|
+// Automatically decompresses plaintext, but returns an error if the decompressed
|
|
+// data would be >250kB or >3x the size of the compressed data, whichever is larger.
|
|
func (obj JSONWebEncryption) DecryptMulti(decryptionKey interface{}) (int, Header, []byte, error) {
|
|
globalHeaders := obj.mergedHeaders(nil)
|
|
|
|
diff --git a/vendor/gopkg.in/square/go-jose.v2/encoding.go b/vendor/gopkg.in/square/go-jose.v2/encoding.go
|
|
index 40b688b..636f6c8 100644
|
|
--- a/vendor/gopkg.in/square/go-jose.v2/encoding.go
|
|
+++ b/vendor/gopkg.in/square/go-jose.v2/encoding.go
|
|
@@ -21,6 +21,7 @@ import (
|
|
"compress/flate"
|
|
"encoding/base64"
|
|
"encoding/binary"
|
|
+ "fmt"
|
|
"io"
|
|
"math/big"
|
|
"strings"
|
|
@@ -85,7 +86,7 @@ func decompress(algorithm CompressionAlgorithm, input []byte) ([]byte, error) {
|
|
}
|
|
}
|
|
|
|
-// Compress with DEFLATE
|
|
+// deflate compresses the input.
|
|
func deflate(input []byte) ([]byte, error) {
|
|
output := new(bytes.Buffer)
|
|
|
|
@@ -97,15 +98,27 @@ func deflate(input []byte) ([]byte, error) {
|
|
return output.Bytes(), err
|
|
}
|
|
|
|
-// Decompress with DEFLATE
|
|
+// inflate decompresses the input.
|
|
+//
|
|
+// Errors if the decompressed data would be >250kB or >10x the size of the
|
|
+// compressed data, whichever is larger.
|
|
func inflate(input []byte) ([]byte, error) {
|
|
output := new(bytes.Buffer)
|
|
reader := flate.NewReader(bytes.NewBuffer(input))
|
|
|
|
- _, err := io.Copy(output, reader)
|
|
- if err != nil {
|
|
+ maxCompressedSize := 10 * int64(len(input))
|
|
+ if maxCompressedSize < 250000 {
|
|
+ maxCompressedSize = 250000
|
|
+ }
|
|
+
|
|
+ limit := maxCompressedSize + 1
|
|
+ n, err := io.CopyN(output, reader, limit)
|
|
+ if err != nil && err != io.EOF {
|
|
return nil, err
|
|
}
|
|
+ if n == limit {
|
|
+ return nil, fmt.Errorf("uncompressed data would be too large (>%d bytes)", maxCompressedSize)
|
|
+ }
|
|
|
|
err = reader.Close()
|
|
return output.Bytes(), err
|