Skip to content

Compact should verify correct quantity of . separated segments #145

@Erik1000

Description

@Erik1000

In the FromStr implementation:

jose/src/format/compact.rs

Lines 105 to 116 in 15abbd4

impl FromStr for Compact {
type Err = NoBase64UrlString;
/// Verifies if every part of the string is valid base64url format
fn from_str(s: &str) -> Result<Self, Self::Err> {
let parts = s
.split('.')
.map(Base64UrlString::from_str)
.collect::<Result<Vec<_>, _>>()?;
Ok(Self { parts })
}
}

We do not check if the quantity matches. For JWS it would be 3 segments, for JWE 5. I think it would be smart to check the correct length as well and not only in the decode operation.

jose/src/jws.rs

Lines 420 to 429 in 15abbd4

impl<C, T: FromRawPayload<Context = C>> DecodeFormatWithContext<Compact, C>
for JsonWebSignature<Compact, T>
{
type Decoded<D> = Unverified<D>;
type Error = ParseCompactError<T::Error>;
fn decode_with_context(input: Compact, context: &C) -> Result<Unverified<Self>, Self::Error> {
if input.len() != 3 {
return Err(ParseCompactError::InvalidLength);
}

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions