jws/jwe: split token into fixed number of parts

[drakkan]

this avoid to use eccessive memory when processing maliciously crafted tokens with a large number of '.' characters.

See also:

golang/go#71490
GHSA-c6gw-w398-hv78

[lestrrat]

@drakkan If this is done for safety, I wonder if using bytes.SplitN using n + 1 as the number of expected segments would be better?

For example

input := []byte("one.two.three")
expectedSegments := 3
split := bytes.SplitN(input, []byte{'.'}, expectedSegments+1)

if len(split) != expectedSegments {
   return ...
}

[lestrrat]

@drakkan Oh, I think I get it. You want to avoid creating that extra slice of bytes, which could contain potentially very large amounts of garbage. I guess in that case Count would be better.

[drakkan]

@drakkan Oh, I think I get it. You want to avoid creating that extra slice of bytes, which could contain potentially very large amounts of garbage. I guess in that case Count would be better.

yes, thank you.

The Go project and also jose reported this as a security issue. I think it's a bit excessive but if possible a new version with the fix would help (I'm fine using an unreleased tag until this will happen). Thanks in advance