Skip to content

Commit

Permalink
Fix a p2c limit value
Browse files Browse the repository at this point in the history
  • Loading branch information
hidekatsu-izuno committed Jan 10, 2024
1 parent 8b60bd0 commit 7e448ce
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions src/jwe/alg/pbes2_hmac_aeskw.rs
Original file line number Diff line number Diff line change
Expand Up @@ -386,7 +386,7 @@ impl JweDecrypter for Pbes2HmacAeskwJweDecrypter {
None => bail!("The p2c header claim is required."),
};

if p2c > 10000 {
if p2c > 1000000 {
bail!("The p2c value is too large. This is a possible DoS attack: {}", p2c);
}

Expand Down Expand Up @@ -503,15 +503,15 @@ mod tests {
};

let mut encrypter = alg.encrypter_from_jwk(&jwk)?;
encrypter.set_iter_count(10001);
encrypter.set_iter_count(1000001);
let mut out_header = header.clone();
let src_key = util::random_bytes(enc.key_len());
let encrypted_key = encrypter.encrypt(&src_key, &header, &mut out_header)?;

let decrypter = alg.decrypter_from_jwk(&jwk)?;

let err = decrypter.decrypt(encrypted_key.as_deref(), &enc, &out_header).unwrap_err();
assert_eq!(format!("{}", err), "Invalid JWE format: The p2c value is too large. This is a possible DoS attack: 10001");
assert_eq!(format!("{}", err), "Invalid JWE format: The p2c value is too large. This is a possible DoS attack: 1000001");
}

Ok(())
Expand Down

0 comments on commit 7e448ce

Please sign in to comment.