jose - npm Package Compare versions

Comparing version 4.9.1 to 4.9.2

dist/browser/jwe/flattened/decrypt.js

@@ -98,6 +98,6 @@ import { decode as base64url } from '../../runtime/base64url.js';
     try {
-        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader);
+        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader, options);
     }
     catch (err) {
-        if (err instanceof TypeError) {
+        if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
             throw err;
@@ -104,0 +104,0 @@ }

dist/browser/lib/decrypt_key_management.js

@@ -12,3 +12,3 @@ import { unwrap as aesKw } from '../runtime/aeskw.js';
 import { unwrap as aesGcmKw } from './aesgcmkw.js';
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
     checkKeyType(alg, key, 'decrypt');
@@ -67,2 +67,5 @@ switch (alg) {
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
@@ -69,0 +72,0 @@ throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);

dist/node/cjs/jwe/flattened/decrypt.js

@@ -101,6 +101,6 @@ "use strict";
     try {
-        cek = await (0, decrypt_key_management_js_1.default)(alg, key, encryptedKey, joseHeader);
+        cek = await (0, decrypt_key_management_js_1.default)(alg, key, encryptedKey, joseHeader, options);
     }
     catch (err) {
-        if (err instanceof TypeError) {
+        if (err instanceof TypeError || err instanceof errors_js_1.JWEInvalid || err instanceof errors_js_1.JOSENotSupported) {
             throw err;
@@ -107,0 +107,0 @@ }

dist/node/cjs/lib/decrypt_key_management.js

@@ -14,3 +14,3 @@ "use strict";
 const aesgcmkw_js_1 = require("./aesgcmkw.js");
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
     (0, check_key_type_js_1.default)(alg, key, 'decrypt');
@@ -69,2 +69,5 @@ switch (alg) {
                 throw new errors_js_1.JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new errors_js_1.JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
@@ -71,0 +74,0 @@ throw new errors_js_1.JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);

dist/node/esm/jwe/flattened/decrypt.js

@@ -98,6 +98,6 @@ import { decode as base64url } from '../../runtime/base64url.js';
     try {
-        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader);
+        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader, options);
     }
     catch (err) {
-        if (err instanceof TypeError) {
+        if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
             throw err;
@@ -104,0 +104,0 @@ }

dist/node/esm/lib/decrypt_key_management.js

@@ -12,3 +12,3 @@ import { unwrap as aesKw } from '../runtime/aeskw.js';
 import { unwrap as aesGcmKw } from './aesgcmkw.js';
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
     checkKeyType(alg, key, 'decrypt');
@@ -67,2 +67,5 @@ switch (alg) {
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
@@ -69,0 +72,0 @@ throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);

dist/types/types.d.ts

@@ -404,2 +404,9 @@ /**
   inflateRaw?: InflateFunction
+
+  /**
+   * (PBES2 Key Management Algorithms only) Maximum allowed "p2c" (PBES2 Count) Header Parameter
+   * value. The PBKDF2 iteration count defines the algorithm's computational expense. By default
+   * this value is set to 10000.
+   */
+  maxPBES2Count?: number
 }
@@ -406,0 +413,0 @@

package.json

 {
   "name": "jose",
-  "version": "4.9.1",
+  "version": "4.9.2",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
@@ -5,0 +5,0 @@ "keywords": [

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

550315

increased by0.24%

Lines of code

13587

increased by0.11%

No dependency changes