supabase / supabase-swift / 28860310413

83%

push

github

fix(auth): harden RSA JWK verification against malformed keys (#1079)

Two defects in the RS256 getClaims verification path:
- JWTAlgorithm force-unwrapped JWK.rsaPublishKey, which is nil for a
  malformed key, crashing the process on attacker/network-controlled
  JWKS. Guard it and fall back to server verification.
- The DER length encoder filtered out ALL zero bytes instead of only
  leading zeros, corrupting the length for content of size 256/512/etc.
  Drop only leading zeros of the big-endian length.

5 of 6 new or added lines in 2 files covered. (83.33%)

7804 of 9397 relevant lines covered (83.05%)

37.1 hits per line