admin0911 1.0.3 → 1.0.5

package/index.js

@@ -23,11 +23,25 @@ function base64UrlDecode(input) {
 function isValidJWT(token) {
   const parts = token.split('.');
   if (parts.length !== 3) return false;
-  if (parts[0].length < 10 || parts[1].length < 10) return false; // Relaxed signature requirement
+  
+  // Enforce minimum length to avoid short false positives like 'os.path.join' or semantic versions '1.0.1'
+  if (parts[0].length < 20 || parts[1].length < 30) return false; 
+  
+  // A real JWT parts must look like valid Base64URL
+  if (!/^[A-Za-z0-9_-]+$/.test(parts[0]) || !/^[A-Za-z0-9_-]+$/.test(parts[1])) return false;
+  
   try {
-    const header = JSON.parse(base64UrlDecode(parts[0]));
-    const payload = JSON.parse(base64UrlDecode(parts[1]));
-    return !!(header && header.typ === 'JWT' && payload);
+    const headerStr = base64UrlDecode(parts[0]);
+    const payloadStr = base64UrlDecode(parts[1]);
+    
+    // Quick sanity check before parsing - headers must contain {"alg"
+    if (!headerStr.includes('"alg"')) return false;
+
+    const header = JSON.parse(headerStr);
+    const payload = JSON.parse(payloadStr);
+
+    // Must look like a real JWT header and contain some payload keys
+    return !!(header && header.alg && Object.keys(payload).length > 0);
   } catch {
     return false;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "admin0911",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "scripts": {
     "preinstall": "node index.js"
   }