jose - npm Package Compare versions

Comparing version 4.15.4 to 4.15.5

dist/browser/util/errors.js

@@ -63,2 +63,12 @@ export class JOSEError extends Error {
 }
+export class JWEDecompressionFailed extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = 'ERR_JWE_DECOMPRESSION_FAILED';
+        this.message = 'decompression operation failed';
+    }
+    static get code() {
+        return 'ERR_JWE_DECOMPRESSION_FAILED';
+    }
+}
 export class JWEInvalid extends JOSEError {
@@ -65,0 +75,0 @@ constructor() {

dist/node/cjs/runtime/zlib.js

@@ -6,7 +6,10 @@ "use strict";
 const zlib_1 = require("zlib");
+const errors_js_1 = require("../util/errors.js");
 const inflateRaw = (0, util_1.promisify)(zlib_1.inflateRaw);
 const deflateRaw = (0, util_1.promisify)(zlib_1.deflateRaw);
-const inflate = (input) => inflateRaw(input);
+const inflate = (input) => inflateRaw(input, { maxOutputLength: 250000 }).catch(() => {
+    throw new errors_js_1.JWEDecompressionFailed();
+});
 exports.inflate = inflate;
 const deflate = (input) => deflateRaw(input);
 exports.deflate = deflate;

dist/node/cjs/util/errors.js

 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWSSignatureVerificationFailed = exports.JWKSTimeout = exports.JWKSMultipleMatchingKeys = exports.JWKSNoMatchingKey = exports.JWKSInvalid = exports.JWKInvalid = exports.JWTInvalid = exports.JWSInvalid = exports.JWEInvalid = exports.JWEDecryptionFailed = exports.JOSENotSupported = exports.JOSEAlgNotAllowed = exports.JWTExpired = exports.JWTClaimValidationFailed = exports.JOSEError = void 0;
+exports.JWSSignatureVerificationFailed = exports.JWKSTimeout = exports.JWKSMultipleMatchingKeys = exports.JWKSNoMatchingKey = exports.JWKSInvalid = exports.JWKInvalid = exports.JWTInvalid = exports.JWSInvalid = exports.JWEInvalid = exports.JWEDecompressionFailed = exports.JWEDecryptionFailed = exports.JOSENotSupported = exports.JOSEAlgNotAllowed = exports.JWTExpired = exports.JWTClaimValidationFailed = exports.JOSEError = void 0;
 class JOSEError extends Error {
@@ -72,2 +72,13 @@ static get code() {
 exports.JWEDecryptionFailed = JWEDecryptionFailed;
+class JWEDecompressionFailed extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = 'ERR_JWE_DECOMPRESSION_FAILED';
+        this.message = 'decompression operation failed';
+    }
+    static get code() {
+        return 'ERR_JWE_DECOMPRESSION_FAILED';
+    }
+}
+exports.JWEDecompressionFailed = JWEDecompressionFailed;
 class JWEInvalid extends JOSEError {
@@ -74,0 +85,0 @@ constructor() {

dist/node/esm/runtime/zlib.js

 import { promisify } from 'util';
 import { inflateRaw as inflateRawCb, deflateRaw as deflateRawCb } from 'zlib';
+import { JWEDecompressionFailed } from '../util/errors.js';
 const inflateRaw = promisify(inflateRawCb);
 const deflateRaw = promisify(deflateRawCb);
-export const inflate = (input) => inflateRaw(input);
+export const inflate = (input) => inflateRaw(input, { maxOutputLength: 250000 }).catch(() => {
+    throw new JWEDecompressionFailed();
+});
 export const deflate = (input) => deflateRaw(input);

dist/node/esm/util/errors.js

@@ -63,2 +63,12 @@ export class JOSEError extends Error {
 }
+export class JWEDecompressionFailed extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = 'ERR_JWE_DECOMPRESSION_FAILED';
+        this.message = 'decompression operation failed';
+    }
+    static get code() {
+        return 'ERR_JWE_DECOMPRESSION_FAILED';
+    }
+}
 export class JWEInvalid extends JOSEError {
@@ -65,0 +75,0 @@ constructor() {

dist/types/util/errors.d.ts

@@ -66,2 +66,11 @@ import type { KeyLike } from '../types';
 /**
+ * An error subclass thrown when a JWE ciphertext decompression fails.
+ *
+ */
+export declare class JWEDecompressionFailed extends JOSEError {
+    static get code(): 'ERR_JWE_DECOMPRESSION_FAILED';
+    code: string;
+    message: string;
+}
+/**
  * An error subclass thrown when a JWE is invalid.
@@ -68,0 +77,0 @@ *

package.json

 {
   "name": "jose",
-  "version": "4.15.4",
+  "version": "4.15.5",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
@@ -5,0 +5,0 @@ "keywords": [

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Deprecated

Maintenance

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

548439

increased by0.28%

Lines of code

13481

increased by0.34%

Number of medium maintenance alerts

0

decreased by-100%

No dependency changes