fix: validate compact value size before split

Author: lepture

src/joserfc/_rfc7515/registry.py

@@ -100,6 +100,11 @@ def check_header(self, header: Header) -> None:
         if self.strict_check_header:
             check_supported_header(self.header_registry, header)
 
+    def validate_compact_value_size(self, value: bytes) -> None:
+        max_length = self.max_header_length + self.max_payload_length + self.max_signature_length
+        if value and len(value) > max_length:
+            raise ExceededSizeError(f"Value size exceeds {max_length} bytes.")
+
     def validate_header_size(self, header: bytes) -> None:
         if header and len(header) > self.max_header_length:
             raise ExceededSizeError(f"Header size exceeds {self.max_header_length} bytes.")

src/joserfc/_rfc7516/compact.py

@@ -34,6 +34,8 @@ def represent_compact(obj: CompactEncryption) -> bytes:
 
 
 def extract_compact(value: bytes, registry: JWERegistry) -> CompactEncryption:
+    registry.validate_compact_value_size(value)
+
     parts = value.split(b".")
     if len(parts) != 5:
         raise ValueError("Invalid JSON Web Encryption")

src/joserfc/_rfc7516/registry.py

@@ -106,6 +106,17 @@ def check_header(self, header: Header, check_more: bool = False) -> None:
         elif self.strict_check_header:
             check_supported_header(self.header_registry, header)
 
+    def validate_compact_value_size(self, value: bytes) -> None:
+        max_length = (
+            self.max_protected_header_length
+            + self.max_encrypted_key_length
+            + self.max_initialization_vector_length
+            + self.max_ciphertext_length
+            + self.max_auth_tag_length
+        )
+        if value and len(value) > max_length:
+            raise ExceededSizeError(f"Value size exceeds {max_length} bytes.")
+
     def validate_protected_header_size(self, header: bytes) -> None:
         if header and len(header) > self.max_protected_header_length:
             raise ExceededSizeError(f"Header size exceeds {self.max_protected_header_length} bytes.")

src/joserfc/_rfc7797/compact.py

@@ -37,13 +37,15 @@ def extract_rfc7515_compact(
     :param registry: optional JWSRegistry instance
     :raise DecodeError: when decoding fails
     """
+    if registry is None:
+        registry = default_registry
+
+    registry.validate_compact_value_size(value)
+
     parts = value.split(b".")
     if len(parts) != 3:
         raise DecodeError("Invalid JSON Web Signature")
 
-    if registry is None:
-        registry = default_registry
-
     header_segment, payload_segment, signature_segment = parts
 
     registry.validate_header_size(header_segment)