@sd-jwt/core 0.20.1-next.2 → 0.20.1-next.3

package/dist/index.js

@@ -1117,6 +1117,23 @@ var pack = (claims, disclosureFrame, hash, saltGenerator) => __async(null, null,
 });
 
 // src/index.ts
+function validateReservedFieldsInternal(payload) {
+  const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY, SD_LIST_KEY]);
+  const visit = (node) => {
+    if (!node || typeof node !== "object") {
+      return;
+    }
+    for (const [key, value] of Object.entries(
+      node
+    )) {
+      if (reservedFields.has(key)) {
+        throw new SDJWTException(`Reserved field name "${key}" is not allowed`);
+      }
+      visit(value);
+    }
+  };
+  visit(payload);
+}
 var _SDJwtInstance = class _SDJwtInstance {
   constructor(userConfig) {
     this.userConfig = {};
@@ -1212,23 +1229,7 @@ var _SDJwtInstance = class _SDJwtInstance {
    * @returns
    */
   validateReservedFields(payload) {
-    const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY]);
-    const visit = (node) => {
-      if (!node || typeof node !== "object") {
-        return;
-      }
-      for (const [key, value] of Object.entries(
-        node
-      )) {
-        if (reservedFields.has(key)) {
-          throw new SDJWTException(
-            `Reserved field name "${key}" is not allowed`
-          );
-        }
-        visit(value);
-      }
-    };
-    visit(payload);
+    validateReservedFieldsInternal(payload);
   }
   validateDisclosureFrame(_disclosureFrame) {
     return;
@@ -1514,6 +1515,7 @@ var _SDJwtInstance = class _SDJwtInstance {
       }
       const verifiedPayloads = yield this.VerifyJwt(sdjwt.jwt, options);
       const claims = yield sdjwt.getClaims(hasher);
+      validateReservedFieldsInternal(claims);
       return { payload: claims, header: verifiedPayloads.header };
     });
   }
@@ -1653,23 +1655,7 @@ var SDJwtGeneralJSONInstance = class {
    * @returns
    */
   validateReservedFields(payload) {
-    const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY]);
-    const visit = (node) => {
-      if (!node || typeof node !== "object") {
-        return;
-      }
-      for (const [key, value] of Object.entries(
-        node
-      )) {
-        if (reservedFields.has(key)) {
-          throw new SDJWTException(
-            `Reserved field name "${key}" is not allowed`
-          );
-        }
-        visit(value);
-      }
-    };
-    visit(payload);
+    validateReservedFieldsInternal(payload);
   }
   validateDisclosureFrame(_disclosureFrame) {
     return;
@@ -1820,6 +1806,7 @@ var SDJwtGeneralJSONInstance = class {
         throw new SDJWTException("Invalid SD JWT");
       }
       const claims = yield sdjwt.getClaims(hasher);
+      validateReservedFieldsInternal(claims);
       return { payload: claims, headers: results.map((r) => r.header) };
     });
   }

package/dist/index.mjs

@@ -1058,6 +1058,23 @@ var pack = (claims, disclosureFrame, hash, saltGenerator) => __async(null, null,
 });
 
 // src/index.ts
+function validateReservedFieldsInternal(payload) {
+  const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY, SD_LIST_KEY]);
+  const visit = (node) => {
+    if (!node || typeof node !== "object") {
+      return;
+    }
+    for (const [key, value] of Object.entries(
+      node
+    )) {
+      if (reservedFields.has(key)) {
+        throw new SDJWTException(`Reserved field name "${key}" is not allowed`);
+      }
+      visit(value);
+    }
+  };
+  visit(payload);
+}
 var _SDJwtInstance = class _SDJwtInstance {
   constructor(userConfig) {
     this.userConfig = {};
@@ -1153,23 +1170,7 @@ var _SDJwtInstance = class _SDJwtInstance {
    * @returns
    */
   validateReservedFields(payload) {
-    const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY]);
-    const visit = (node) => {
-      if (!node || typeof node !== "object") {
-        return;
-      }
-      for (const [key, value] of Object.entries(
-        node
-      )) {
-        if (reservedFields.has(key)) {
-          throw new SDJWTException(
-            `Reserved field name "${key}" is not allowed`
-          );
-        }
-        visit(value);
-      }
-    };
-    visit(payload);
+    validateReservedFieldsInternal(payload);
   }
   validateDisclosureFrame(_disclosureFrame) {
     return;
@@ -1455,6 +1456,7 @@ var _SDJwtInstance = class _SDJwtInstance {
       }
       const verifiedPayloads = yield this.VerifyJwt(sdjwt.jwt, options);
       const claims = yield sdjwt.getClaims(hasher);
+      validateReservedFieldsInternal(claims);
       return { payload: claims, header: verifiedPayloads.header };
     });
   }
@@ -1594,23 +1596,7 @@ var SDJwtGeneralJSONInstance = class {
    * @returns
    */
   validateReservedFields(payload) {
-    const reservedFields = /* @__PURE__ */ new Set([SD_DIGEST, "_sd_alg", SD_DECOY]);
-    const visit = (node) => {
-      if (!node || typeof node !== "object") {
-        return;
-      }
-      for (const [key, value] of Object.entries(
-        node
-      )) {
-        if (reservedFields.has(key)) {
-          throw new SDJWTException(
-            `Reserved field name "${key}" is not allowed`
-          );
-        }
-        visit(value);
-      }
-    };
-    visit(payload);
+    validateReservedFieldsInternal(payload);
   }
   validateDisclosureFrame(_disclosureFrame) {
     return;
@@ -1761,6 +1747,7 @@ var SDJwtGeneralJSONInstance = class {
         throw new SDJWTException("Invalid SD JWT");
       }
       const claims = yield sdjwt.getClaims(hasher);
+      validateReservedFieldsInternal(claims);
       return { payload: claims, headers: results.map((r) => r.header) };
     });
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sd-jwt/core",
-  "version": "0.20.1-next.2+a1ae536",
+  "version": "0.20.1-next.3+7390003",
   "description": "sd-jwt draft 7 implementation in typescript",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -58,5 +58,5 @@
       "esm"
     ]
   },
-  "gitHead": "a1ae5366775a74770f58ef04fe12d6ad6df8eb1a"
+  "gitHead": "73900032a1c009d05583c1a422073f8eab0fa276"
 }

package/src/index.ts

@@ -14,6 +14,7 @@ import {
   type SafeVerifyResult,
   SD_DECOY,
   SD_DIGEST,
+  SD_LIST_KEY,
   type SDJWTCompact,
   type SDJWTConfig,
   type Signer,
@@ -42,6 +43,32 @@ export * from './utils';
 
 export type SdJwtPayload = Record<string, unknown>;
 
+/**
+ * Internal utility function to validate that a payload does not contain reserved field names.
+ */
+function validateReservedFieldsInternal(
+  payload: Record<string, unknown>,
+): void {
+  const reservedFields = new Set([SD_DIGEST, '_sd_alg', SD_DECOY, SD_LIST_KEY]);
+
+  const visit = (node: unknown) => {
+    if (!node || typeof node !== 'object') {
+      return;
+    }
+
+    for (const [key, value] of Object.entries(
+      node as Record<string, unknown>,
+    )) {
+      if (reservedFields.has(key)) {
+        throw new SDJWTException(`Reserved field name "${key}" is not allowed`);
+      }
+      visit(value);
+    }
+  };
+
+  visit(payload);
+}
+
 export class SDJwtInstance<ExtendedPayload extends SdJwtPayload, T = unknown> {
   //header type
   protected type?: string;
@@ -163,26 +190,7 @@ export class SDJwtInstance<ExtendedPayload extends SdJwtPayload, T = unknown> {
    * @returns
    */
   protected validateReservedFields<T extends ExtendedPayload>(payload: T) {
-    const reservedFields = new Set([SD_DIGEST, '_sd_alg', SD_DECOY]);
-
-    const visit = (node: unknown) => {
-      if (!node || typeof node !== 'object') {
-        return;
-      }
-
-      for (const [key, value] of Object.entries(
-        node as Record<string, unknown>,
-      )) {
-        if (reservedFields.has(key)) {
-          throw new SDJWTException(
-            `Reserved field name "${key}" is not allowed`,
-          );
-        }
-        visit(value);
-      }
-    };
-
-    visit(payload);
+    validateReservedFieldsInternal(payload as Record<string, unknown>);
   }
 
   protected validateDisclosureFrame<T extends ExtendedPayload>(
@@ -532,6 +540,8 @@ export class SDJwtInstance<ExtendedPayload extends SdJwtPayload, T = unknown> {
 
     const verifiedPayloads = await this.VerifyJwt(sdjwt.jwt, options);
     const claims = await sdjwt.getClaims<ExtendedPayload>(hasher);
+    // Validate that unpacked claims do not contain reserved field names
+    validateReservedFieldsInternal(claims);
     return { payload: claims, header: verifiedPayloads.header };
   }
 
@@ -706,26 +716,7 @@ export class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
    * @returns
    */
   protected validateReservedFields<T extends ExtendedPayload>(payload: T) {
-    const reservedFields = new Set([SD_DIGEST, '_sd_alg', SD_DECOY]);
-
-    const visit = (node: unknown) => {
-      if (!node || typeof node !== 'object') {
-        return;
-      }
-
-      for (const [key, value] of Object.entries(
-        node as Record<string, unknown>,
-      )) {
-        if (reservedFields.has(key)) {
-          throw new SDJWTException(
-            `Reserved field name "${key}" is not allowed`,
-          );
-        }
-        visit(value);
-      }
-    };
-
-    visit(payload);
+    validateReservedFieldsInternal(payload as Record<string, unknown>);
   }
 
   protected validateDisclosureFrame<T extends ExtendedPayload>(
@@ -901,6 +892,8 @@ export class SDJwtGeneralJSONInstance<ExtendedPayload extends SdJwtPayload> {
     }
 
     const claims = await sdjwt.getClaims<ExtendedPayload>(hasher);
+    // Validate that unpacked claims do not contain reserved field names
+    validateReservedFieldsInternal(claims);
     return { payload: claims, headers: results.map((r) => r.header) };
   }
 

package/src/test/index.spec.ts

@@ -4,6 +4,7 @@ import { exportJWK, importJWK, type JWK } from 'jose';
 import { describe, expect, test } from 'vitest';
 import { SDJwtInstance, type SdJwtPayload } from '../index';
 import type { JwtPayload, KbVerifier, Signer, Verifier } from '../types';
+import { Disclosure } from '../utils';
 
 // Extract the major version as a number
 const nodeVersionMajor = Number.parseInt(
@@ -126,6 +127,50 @@ describe('index', () => {
     ).rejects.toThrow('Reserved field name "_sd" is not allowed');
   });
 
+  test.each([
+    '_sd',
+    '...',
+  ])('validate rejects disclosure resolving to reserved claim name %s', async (reservedClaimName) => {
+    const { signer, verifier } = createSignerVerifier();
+    const sdjwt = new SDJwtInstance<SdJwtPayload>({
+      signer,
+      signAlg: 'EdDSA',
+      verifier,
+      hasher: digest,
+      saltGenerator: generateSalt,
+    });
+
+    const disclosure = new Disclosure([
+      await generateSalt(16),
+      reservedClaimName,
+      'reserved',
+    ]);
+    const disclosureDigest = await disclosure.digest({
+      hasher: digest,
+      alg: 'sha-256',
+    });
+    const header = Buffer.from(JSON.stringify({ alg: 'EdDSA' })).toString(
+      'base64url',
+    );
+    const payload = Buffer.from(
+      JSON.stringify({
+        _sd: [disclosureDigest],
+        iss: 'Issuer',
+        iat: Math.floor(Date.now() / 1000),
+        vct: '',
+        _sd_alg: 'sha-256',
+      }),
+    ).toString('base64url');
+    const unsignedJwt = `${header}.${payload}`;
+    const signature = await signer(unsignedJwt);
+
+    await expect(
+      sdjwt.validate(`${unsignedJwt}.${signature}~${disclosure.encode()}~`),
+    ).rejects.toThrow(
+      `Reserved field name "${reservedClaimName}" is not allowed`,
+    );
+  });
+
   test('verify failed', async () => {
     const { signer } = createSignerVerifier();
     const { publicKey } = Crypto.generateKeyPairSync('ed25519');
@@ -236,7 +281,7 @@ describe('index', () => {
         // use the key from the cnf
         publicKey = payload.cnf.jwk;
       } else {
-        throw Error('key binding not supported');
+        throw new Error('key binding not supported');
       }
       // get the key of the holder to verify the signature
       return Crypto.verify(
@@ -304,7 +349,7 @@ describe('index', () => {
       sig: string,
       payload: JwtPayload,
     ) => {
-      if (!payload.cnf) throw Error('key binding not supported');
+      if (!payload.cnf) throw new Error('key binding not supported');
       return Crypto.verify(
         null,
         Buffer.from(data),
@@ -372,7 +417,7 @@ describe('index', () => {
       sig: string,
       payload: JwtPayload,
     ) => {
-      if (!payload.cnf) throw Error('key binding not supported');
+      if (!payload.cnf) throw new Error('key binding not supported');
       return Crypto.verify(
         null,
         Buffer.from(data),