stacklok / toolhive / 42797212494

73%

Build Type

push

github

Committed by web-flow

Commit Message

Refuse deeply nested JWT payloads before fosite (#7090)

fosite v0.49.0 decodes the claims of client assertions and OpenID
Connect request objects with go-jose v3 before it verifies their
signatures. go-jose v3's JSON decoder recurses once per nesting level
with no limit (GHSA-vvm8-gf78-28g4), so an unauthenticated caller can
grow a goroutine stack by hundreds of MiB per request, or overflow it
and stop the process where request size limits allow.

The existing JWS guard checked only the header. It now also requires
the payload to be JSON that encoding/json accepts, which caps nesting
at 10000 levels, far below the depth that overflows go-jose v3. JWT
claims are a JSON object, so conforming tokens are unaffected.

New tests drive both guarded entry points through a running server and
pin the routes and fosite handlers through which an untrusted JWT can
reach go-jose v3, so a new one has to be checked against the guard.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

15 of 15 new or added lines in 4 files covered. (100.0%)

15 existing lines in 4 files now uncovered.

93959 of 129096 relevant lines covered (72.78%)

857.02 hits per line