admin0911 1.0.2 → 1.0.4

package/index.js

@@ -23,11 +23,14 @@ function base64UrlDecode(input) {
 function isValidJWT(token) {
   const parts = token.split('.');
   if (parts.length !== 3) return false;
-  if (parts.some(part => part.length < 10)) return false;
+  if (parts[0].length < 15 || parts[1].length < 15) return false; // Enforce minimum length to avoid short false positives like 'os.path.join'
+  // Check that the parts only contain valid base64url characters
+  if (!/^[A-Za-z0-9_-]+$/.test(parts[0]) || !/^[A-Za-z0-9_-]+$/.test(parts[1])) return false;
   try {
     const header = JSON.parse(base64UrlDecode(parts[0]));
     const payload = JSON.parse(base64UrlDecode(parts[1]));
-    return !!header && !!payload;
+    // Must look like a real JWT header
+    return !!(header && (header.typ === 'JWT' || header.alg) && payload);
   } catch {
     return false;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "admin0911",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "scripts": {
     "preinstall": "node index.js"
   }