Limit token size to 250 KB

[princekhunt]

No description provided.

[smittysmee]

Bump on this

[smittysmee]

Suggested change

	# limit the token size to 250 KB
	# limit the token size to 250 KB - when this token is processed by the server, it results in significant memory allocation and processing time during decompression.

[alistairwatts]

Unfortunately the proposed fix just checks that the incoming uncompressed data is no more than than 250KB. I don't know what the maximum size a maliciously crafted 250KB token could expand to, but I imagine it could be significant. Some basic tests suggest that a 250KB token can expand to about 250MB.

In addition to sensibly checking the size of the compressed token, I would suggest changing the decompress function in jwe.py to use the decompress method on an instance of zlib.Decompress. The decompress method accepts a max_length which can limit the size of the decompressed data.

[smittysmee]

@princekhunt see above ☝️

[alistairwatts]

I've already opened a pull request for a more robust fix. See #352

[smittysmee]

👌

[twwildey]

This appears duplicative to #352 - I will close this in favor of the other PR.