Merge pull request #675 from web-token/hardening/compact-serializer-explode-limit

fix(core): bound the compact serializers' segment split

Author: Spomky

src/Library/Encryption/Serializer/CompactSerializer.php

@@ -54,10 +54,16 @@ public function serialize(JWE $jwe, ?int $recipientIndex = null): string
         );
     }
 
+    /**
+     * The split is bounded to six segments: a valid compact JWE has exactly five, so a sixth one is enough to
+     * detect and reject any longer input. Without that bound, a delimiter-heavy string would be expanded into one
+     * array entry per delimiter before the segment count is checked, which costs about twenty-five times the size
+     * of the input in memory.
+     */
     #[Override]
     public function unserialize(string $input): JWE
     {
-        $parts = explode('.', $input);
+        $parts = explode('.', $input, 6);
         if (count($parts) !== 5) {
             throw new InvalidArgumentException('Unsupported input');
         }

src/Library/Signature/Serializer/CompactSerializer.php

@@ -58,10 +58,16 @@ public function serialize(JWS $jws, ?int $signatureIndex = null): string
         );
     }
 
+    /**
+     * The split is bounded to four segments: a valid compact JWS has exactly three, so a fourth one is enough to
+     * detect and reject any longer input. Without that bound, a delimiter-heavy string would be expanded into one
+     * array entry per delimiter before the segment count is checked, which costs about twenty-five times the size
+     * of the input in memory.
+     */
     #[Override]
     public function unserialize(string $input): JWS
     {
-        $parts = explode('.', $input);
+        $parts = explode('.', $input, 4);
         if (count($parts) !== 3) {
             throw new InvalidArgumentException('Unsupported input');
         }

tests/Component/Encryption/CompactSerializerTest.php

@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Jose\Tests\Component\Encryption;
+
+use InvalidArgumentException;
+use Jose\Component\Encryption\Serializer\CompactSerializer;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use function memory_get_peak_usage;
+use function memory_get_usage;
+use function memory_reset_peak_usage;
+use function str_repeat;
+
+/**
+ * @internal
+ */
+final class CompactSerializerTest extends TestCase
+{
+    #[Test]
+    public function aTokenWithTooManySegmentsIsRejected(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('Unsupported input');
+
+        (new CompactSerializer())->unserialize('eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4R0NNIn0.....');
+    }
+
+    /**
+     * A delimiter-heavy token must be rejected without expanding it into one array entry per delimiter. The
+     * threshold is deliberately generous: the unbounded split of this input allocates roughly twenty-five times its
+     * size, while the bounded one stays proportional to it.
+     */
+    #[Test]
+    public function aDelimiterHeavyTokenIsRejectedWithoutExhaustingMemory(): void
+    {
+        $token = str_repeat('.', 2_000_000);
+        $serializer = new CompactSerializer();
+        memory_reset_peak_usage();
+        $before = memory_get_usage();
+
+        try {
+            $serializer->unserialize($token);
+            static::fail('The token should have been rejected.');
+        } catch (InvalidArgumentException $e) {
+            static::assertSame('Unsupported input', $e->getMessage());
+        }
+
+        static::assertLessThan(8_000_000, memory_get_peak_usage() - $before);
+    }
+}

tests/Component/Signature/CompactSerializerTest.php

@@ -0,0 +1,52 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Jose\Tests\Component\Signature;
+
+use InvalidArgumentException;
+use Jose\Component\Signature\Serializer\CompactSerializer;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use function memory_get_peak_usage;
+use function memory_get_usage;
+use function memory_reset_peak_usage;
+use function str_repeat;
+
+/**
+ * @internal
+ */
+final class CompactSerializerTest extends TestCase
+{
+    #[Test]
+    public function aTokenWithTooManySegmentsIsRejected(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('Unsupported input');
+
+        (new CompactSerializer())->unserialize('eyJhbGciOiJub25lIn0...');
+    }
+
+    /**
+     * A delimiter-heavy token must be rejected without expanding it into one array entry per delimiter. The
+     * threshold is deliberately generous: the unbounded split of this input allocates roughly twenty-five times its
+     * size, while the bounded one stays proportional to it.
+     */
+    #[Test]
+    public function aDelimiterHeavyTokenIsRejectedWithoutExhaustingMemory(): void
+    {
+        $token = str_repeat('.', 2_000_000);
+        $serializer = new CompactSerializer();
+        memory_reset_peak_usage();
+        $before = memory_get_usage();
+
+        try {
+            $serializer->unserialize($token);
+            static::fail('The token should have been rejected.');
+        } catch (InvalidArgumentException $e) {
+            static::assertSame('Unsupported input', $e->getMessage());
+        }
+
+        static::assertLessThan(8_000_000, memory_get_peak_usage() - $before);
+    }
+}