castrum 0.9.6 → 0.9.8

package/rust/crypto/aead.rs

@@ -36,6 +36,18 @@ fn batch_nonce(base: &[u8], index: usize) -> [u8; NONCE_LEN] {
     nonce
 }
 
+/// Reject a nonce that is not exactly [`NONCE_LEN`] bytes. Guards the batch
+/// entry points, whose `copy_from_slice` would otherwise panic.
+fn validate_nonce(nonce: &[u8]) -> Result<()> {
+    if nonce.len() != NONCE_LEN {
+        return Err(Error::from_reason(format!(
+            "aead nonce must be {NONCE_LEN} bytes, got {}",
+            nonce.len()
+        )));
+    }
+    Ok(())
+}
+
 fn resolve_algorithm(name: Option<&str>) -> Result<&'static aead::Algorithm> {
     match name {
         None | Some("aes-256-gcm") => Ok(&aead::AES_256_GCM),
@@ -197,6 +209,7 @@ pub fn aead_encrypt_batch_packed(
     algorithm: Option<String>,
 ) -> Result<Buffer> {
     let alg = resolve_algorithm(algorithm.as_deref())?;
+    validate_nonce(nonce.as_ref())?;
 
     let enc_for = |plaintext: &[u8], index: usize| -> Vec<u8> {
         let n = batch_nonce(nonce.as_ref(), index);
@@ -220,6 +233,7 @@ pub fn aead_decrypt_batch_packed(
     algorithm: Option<String>,
 ) -> Result<Buffer> {
     let alg = resolve_algorithm(algorithm.as_deref())?;
+    validate_nonce(nonce.as_ref())?;
 
     let dec_for = |ciphertext: &[u8], index: usize| -> Vec<u8> {
         let n = batch_nonce(nonce.as_ref(), index);
@@ -317,6 +331,36 @@ mod tests {
         }
     }
 
+    fn packed_one(bytes: &[u8]) -> Uint8Array {
+        let mut data = Vec::new();
+        data.extend_from_slice(&1u32.to_le_bytes());
+        data.extend_from_slice(&(bytes.len() as u32).to_le_bytes());
+        data.extend_from_slice(bytes);
+        Uint8Array::new(data)
+    }
+
+    #[test]
+    fn batch_rejects_a_non_12_byte_nonce() {
+        // A wrong-length nonce used to panic inside `copy_from_slice` (and the
+        // napi sync trampoline unwinds through extern "C" → abort). It must be
+        // a normal JS error instead.
+        let key = key_bytes();
+        assert!(aead_encrypt_batch_packed(
+            packed_one(b"abc"),
+            Uint8Array::new(key.to_vec()),
+            Uint8Array::new(vec![0u8; 16]),
+            None,
+        )
+        .is_err());
+        assert!(aead_decrypt_batch_packed(
+            packed_one(b"abc"),
+            Uint8Array::new(key.to_vec()),
+            Uint8Array::new(vec![0u8; 8]),
+            None,
+        )
+        .is_err());
+    }
+
     #[test]
     fn batch_nonce_derived_encrypt_roundtrip() {
         // Each item encrypted with its derived nonce decrypts correctly, and a

package/rust/crypto/argon2.rs

@@ -30,8 +30,16 @@ pub struct PasswordHashOptions {
     pub out_len: Option<u32>,
 }
 
+/// Sanity caps for caller-supplied argon2 params: a hostile or mis-set config
+/// must not force a multi-GiB allocation or a multi-minute CPU burn. Generous
+/// enough for any real deployment (defaults are 19 MiB / 2 / 1 / 32).
+pub const ARGON2_MAX_M_COST: u32 = 1_048_576; // 1 GiB, in KiB
+pub const ARGON2_MAX_T_COST: u32 = 64;
+pub const ARGON2_MAX_P_COST: u32 = 64;
+pub const ARGON2_MAX_OUT_LEN: u32 = 1024;
+
 fn resolve_opts(o: Option<&PasswordHashOptions>) -> (u32, u32, u32, u32) {
-    match o {
+    let (m, t, p, out) = match o {
         Some(o) => (
             o.m_cost.unwrap_or(19_456),
             o.t_cost.unwrap_or(2),
@@ -39,7 +47,13 @@ fn resolve_opts(o: Option<&PasswordHashOptions>) -> (u32, u32, u32, u32) {
             o.out_len.unwrap_or(32),
         ),
         None => (19_456, 2, 1, 32),
-    }
+    };
+    (
+        m.min(ARGON2_MAX_M_COST),
+        t.min(ARGON2_MAX_T_COST),
+        p.min(ARGON2_MAX_P_COST),
+        out.min(ARGON2_MAX_OUT_LEN),
+    )
 }
 
 // ── Pure-Rust core ─────────────────────────────────────────────
@@ -230,6 +244,22 @@ mod tests {
         .is_err());
     }
 
+    #[test]
+    fn argon2_params_are_capped() {
+        let (m, t, p, out) = resolve_opts(Some(&PasswordHashOptions {
+            m_cost: Some(u32::MAX),
+            t_cost: Some(u32::MAX),
+            p_cost: Some(u32::MAX),
+            out_len: Some(u32::MAX),
+        }));
+        assert_eq!(m, ARGON2_MAX_M_COST);
+        assert_eq!(t, ARGON2_MAX_T_COST);
+        assert_eq!(p, ARGON2_MAX_P_COST);
+        assert_eq!(out, ARGON2_MAX_OUT_LEN);
+        // Sane defaults pass through untouched.
+        assert_eq!(resolve_opts(None), (19_456, 2, 1, 32));
+    }
+
     #[test]
     fn verify_rejects_wrong_password() {
         let phc = hash_password(PASSWORD, SALT, 4096, 2, 1, 32).unwrap();

package/rust/crypto/jwt/tests.rs

@@ -76,6 +76,25 @@ fn verify_token_enforces_iat_leeway() {
     assert!(verify_token(&near, SECRET, now).is_some());
 }
 
+#[test]
+fn verify_token_rejects_non_integer_or_non_numeric_exp() {
+    let now = 1_000_000i64;
+    // A fractional exp in the PAST must reject. Pre-fix `as_i64()` returned
+    // None for a float, so the expiry check was skipped and the token verified
+    // as never-expiring.
+    let frac_past = token(&serde_json::json!({ "sub": "1", "exp": 999_999.5 }), SECRET);
+    assert!(verify_token(&frac_past, SECRET, now).is_none());
+    // Present-but-non-numeric exp is malformed → reject.
+    let string_exp = token(&serde_json::json!({ "sub": "1", "exp": "999999" }), SECRET);
+    assert!(verify_token(&string_exp, SECRET, now).is_none());
+    // A fractional exp in the FUTURE is a valid RFC 7519 NumericDate → accept.
+    let frac_future = token(
+        &serde_json::json!({ "sub": "1", "exp": 1_000_000.5 }),
+        SECRET,
+    );
+    assert!(verify_token(&frac_future, SECRET, now).is_some());
+}
+
 #[test]
 fn verify_token_accepts_valid_claims() {
     let claims = serde_json::json!({ "sub": "123", "role": "admin" });

package/rust/crypto/jwt/token.rs

@@ -113,19 +113,6 @@ pub fn build_token_with_key(
     signing_input
 }
 
-/// Constant-time byte comparison (no early exit on length mismatch beyond the
-/// required guard — lengths differ → false).
-fn ct_eq(a: &[u8], b: &[u8]) -> bool {
-    if a.len() != b.len() {
-        return false;
-    }
-    let mut diff = 0u8;
-    for (x, y) in a.iter().zip(b.iter()) {
-        diff |= x ^ y;
-    }
-    diff == 0
-}
-
 /// Verify an HS256 signature (constant-time). Does NOT check claims/expiry.
 ///
 /// Test-only convenience over the fresh-key derivation: production code uses
@@ -148,10 +135,11 @@ pub fn verify_signature_with_key(token: &[u8], key: &aws_lc_rs::hmac::Key) -> bo
     signing_input.push(b'.');
     signing_input.extend_from_slice(parts.payload_b64);
 
-    let sig = hmac_sha256_with_key(key, &signing_input);
-
     match base64url_decode_bytes(parts.sig_b64) {
-        Some(provided) => ct_eq(&sig, &provided),
+        // Audited constant-time comparison (aws-lc-rs), matching every other
+        // MAC path in the crate (cookie sign / CSRF / hmac_sha256) instead of a
+        // hand-rolled loop the compiler could optimize into an early exit.
+        Some(provided) => aws_lc_rs::hmac::verify(key, &signing_input, &provided).is_ok(),
         None => false,
     }
 }
@@ -239,31 +227,58 @@ pub(crate) fn verify_time_claims(payload_b64: &[u8], now_seconds: i64) -> Option
     let payload = base64url_decode_bytes(payload_b64)?;
     let value: sonic_rs::Value = sonic_rs::from_slice(&payload).ok()?;
 
+    // RFC 7519 NumericDate may be non-integer, so parse as f64 — `as_i64()`
+    // returns None for a float, which previously SKIPPED the check entirely and
+    // made a token with a fractional `exp` verify as never-expiring. A claim
+    // that is present but not a finite number is malformed → reject.
+    let now = now_seconds as f64;
+
     // `exp`: reject when now >= exp.
-    if let Some(exp) = value.get("exp").and_then(|v| v.as_i64()) {
-        if now_seconds >= exp {
-            return None;
-        }
+    match time_claim(&value, "exp") {
+        TimeClaim::Absent => {}
+        TimeClaim::Invalid => return None,
+        TimeClaim::Value(exp) if now >= exp => return None,
+        TimeClaim::Value(_) => {}
     }
 
     // `nbf` (not before): reject when the token is not yet valid.
-    if let Some(nbf) = value.get("nbf").and_then(|v| v.as_i64()) {
-        if now_seconds < nbf {
-            return None;
-        }
+    match time_claim(&value, "nbf") {
+        TimeClaim::Absent => {}
+        TimeClaim::Invalid => return None,
+        TimeClaim::Value(nbf) if now < nbf => return None,
+        TimeClaim::Value(_) => {}
     }
 
     // `iat` (issued at): reject tokens issued in the future beyond a small
     // clock-skew leeway.
-    if let Some(iat) = value.get("iat").and_then(|v| v.as_i64()) {
-        if now_seconds < iat.saturating_sub(CLOCK_SKEW_LEEWAY_SECS) {
-            return None;
-        }
+    match time_claim(&value, "iat") {
+        TimeClaim::Absent => {}
+        TimeClaim::Invalid => return None,
+        TimeClaim::Value(iat) if now < iat - CLOCK_SKEW_LEEWAY_SECS as f64 => return None,
+        TimeClaim::Value(_) => {}
     }
 
     Some(payload)
 }
 
+/// Parsed state of a JWT time claim: absent, a finite numeric value, or present
+/// but malformed (string / null / non-finite).
+enum TimeClaim {
+    Absent,
+    Value(f64),
+    Invalid,
+}
+
+fn time_claim(value: &sonic_rs::Value, key: &str) -> TimeClaim {
+    match value.get(key) {
+        None => TimeClaim::Absent,
+        Some(v) => match v.as_f64() {
+            Some(n) if n.is_finite() => TimeClaim::Value(n),
+            _ => TimeClaim::Invalid,
+        },
+    }
+}
+
 /// Verify with a PRE-COMPILED key (no per-call key derivation). Time-claim
 /// checks run over a compact `sonic_rs::Value` (zero per-key heap `String`);
 /// the decoded payload bytes are returned verbatim.

package/rust/crypto/session.rs

@@ -41,6 +41,12 @@ pub fn seal_core(id: &[u8], data_json: &[u8], exp_secs: i64, secret: &[u8]) -> O
 /// Verify a sealed token and extract the envelope fields into the packed
 /// layout: `[u8 ok=1][i64 exp][u32 idLen][id][u32 dataLen][dataJson]`.
 /// Returns `None` on bad signature / malformed envelope.
+///
+/// The returned `exp` is **advisory**: this function does NOT compare it to the
+/// current time, so a correctly signed but expired envelope still opens. The
+/// caller MUST reject it (`exp != 0 && now >= exp`). (Enforcing it here was
+/// considered and rejected: the wire contract is signature + extraction, and
+/// the bind-time self-test seals with fixed historical timestamps.)
 pub fn open_core(token: &[u8], secret: &[u8]) -> Option<(i64, Vec<u8>, Vec<u8>)> {
     if secret.is_empty() {
         return None;
@@ -83,13 +89,10 @@ pub fn open_core(token: &[u8], secret: &[u8]) -> Option<(i64, Vec<u8>, Vec<u8>)>
                         if bytes.get(pos) != Some(&b'"') {
                             return None;
                         }
-                        let vs = pos + 1;
-                        let mut ve = vs;
-                        while ve < bytes.len() && bytes[ve] != b'"' {
-                            ve += 1;
-                        }
-                        id = Some(bytes[vs..ve].to_vec());
-                        pos = ve + 1;
+                        let body = pos + 1;
+                        let end = scan_json_string_end(bytes, body)?;
+                        id = Some(unescape_json_id(&bytes[body..end]));
+                        pos = end + 1;
                     }
                     b"exp" => {
                         let vs = pos;
@@ -174,6 +177,108 @@ fn skip_json_value(bytes: &[u8], pos: usize) -> Option<usize> {
     }
 }
 
+/// Index of the `"` that TERMINATES a JSON string whose body starts at `start`
+/// (just past the opening quote).
+///
+/// Escape-aware: the id used to be captured by scanning for the next `"`, which
+/// stops at the quote inside an escaped `\"` — truncating the id AND leaving
+/// `pos` in the middle of the string, so the rest of the envelope was then read
+/// as structure (a quote-carrying id could make `open` fail outright).
+fn scan_json_string_end(bytes: &[u8], start: usize) -> Option<usize> {
+    let mut i = start;
+    while i < bytes.len() {
+        match bytes[i] {
+            b'\\' => i += 2,
+            b'"' => return Some(i),
+            _ => i += 1,
+        }
+    }
+    None
+}
+
+/// Decode 4 hex digits at `at` (the `\uXXXX` payload).
+fn hex4(bytes: &[u8], at: usize) -> Option<u32> {
+    let mut v = 0u32;
+    for k in 0..4 {
+        v = (v << 4) | (*bytes.get(at + k)? as char).to_digit(16)?;
+    }
+    Some(v)
+}
+
+/// Inverse of `json_ser::write_json_escaped` for the id: decodes `\"`, `\\`,
+/// `\/`, `\b`, `\f`, `\n`, `\r`, `\t` and `\uXXXX`.
+///
+/// `\u00XX` maps back to the single BYTE `XX`. That is deliberate and load
+/// bearing: the escaper emits that form for control characters AND — in its
+/// invalid-UTF-8 mode — for every byte of binary input, so routing it through a
+/// code point and re-encoding as UTF-8 would expand bytes >= 0x80 into two
+/// bytes and destroy the byte-exact round trip the id is supposed to have.
+/// (A valid-UTF-8 id is written RAW by the escaper, so `\u00XX` cannot be its
+/// origin.)
+///
+/// `\uXXXX` above 0xFF can only come from a different producer (e.g. JS
+/// `JSON.stringify` of a non-ASCII id), so it is decoded as a code point with
+/// surrogate-pair combining. Unknown escapes and a trailing backslash are kept
+/// verbatim — never silently dropped.
+fn unescape_json_id(escaped: &[u8]) -> Vec<u8> {
+    let mut out = Vec::with_capacity(escaped.len());
+    let mut i = 0usize;
+    while i < escaped.len() {
+        if escaped[i] != b'\\' {
+            out.push(escaped[i]);
+            i += 1;
+            continue;
+        }
+        let Some(&e) = escaped.get(i + 1) else {
+            out.push(b'\\');
+            break;
+        };
+        i += 2;
+        match e {
+            b'"' => out.push(b'"'),
+            b'\\' => out.push(b'\\'),
+            b'/' => out.push(b'/'),
+            b'b' => out.push(0x08),
+            b'f' => out.push(0x0c),
+            b'n' => out.push(b'\n'),
+            b'r' => out.push(b'\r'),
+            b't' => out.push(b'\t'),
+            b'u' => {
+                let Some(cp) = hex4(escaped, i) else {
+                    out.push(b'\\');
+                    out.push(b'u');
+                    continue;
+                };
+                i += 4;
+                if cp <= 0xFF {
+                    out.push(cp as u8);
+                    continue;
+                }
+                let mut code = cp;
+                if (0xD800..=0xDBFF).contains(&cp)
+                    && escaped.get(i) == Some(&b'\\')
+                    && escaped.get(i + 1) == Some(&b'u')
+                {
+                    if let Some(lo) = hex4(escaped, i + 2) {
+                        if (0xDC00..=0xDFFF).contains(&lo) {
+                            code = 0x10000 + ((cp - 0xD800) << 10) + (lo - 0xDC00);
+                            i += 6;
+                        }
+                    }
+                }
+                let mut buf = [0u8; 4];
+                let ch = char::from_u32(code).unwrap_or('\u{FFFD}');
+                out.extend_from_slice(ch.encode_utf8(&mut buf).as_bytes());
+            }
+            other => {
+                out.push(b'\\');
+                out.push(other);
+            }
+        }
+    }
+    out
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -209,6 +314,64 @@ mod tests {
         assert!(seal_core(b"", b"{}", 0, SECRET).is_none());
     }
 
+    #[test]
+    fn id_round_trips_byte_exactly_through_escapes() {
+        // A `"` used to terminate the id scan early, and the id came back
+        // escaped. Both are the same root cause: an escape-unaware scan with no
+        // decode. Every id here must survive the envelope byte-for-byte.
+        for id in [
+            &b"plain-id"[..],
+            &b"sess\"quote"[..],
+            &b"back\\slash"[..],
+            &b"new\nline"[..],
+            &b"tab\there"[..],
+            &b"cr\rhere"[..],
+            &b"nul\0byte"[..],
+            &b"binary\xff\xfe"[..],
+            &b"trailing\\"[..],
+        ] {
+            let token = seal_core(id, br#"{"a":1}"#, 42, SECRET).expect("seal");
+            let (exp, got, data) = open_core(&token, SECRET).expect("open");
+            assert_eq!(got, id, "id must round-trip byte-exactly");
+            assert_eq!(exp, 42);
+            assert_eq!(data, br#"{"a":1}"#);
+        }
+    }
+
+    #[test]
+    fn unescape_json_id_matches_the_escaper() {
+        assert_eq!(unescape_json_id(br#"a\"b"#), b"a\"b");
+        assert_eq!(unescape_json_id(br#"a\\b"#), b"a\\b");
+        assert_eq!(unescape_json_id(br#"a\/b"#), b"a/b");
+        assert_eq!(unescape_json_id(br#"a\nb"#), b"a\nb");
+        assert_eq!(unescape_json_id(br#"a\rb"#), b"a\rb");
+        assert_eq!(unescape_json_id(br#"a\tb"#), b"a\tb");
+        assert_eq!(unescape_json_id(br#"a\bb"#), b"a\x08b");
+        assert_eq!(unescape_json_id(br#"a\fb"#), b"a\x0cb");
+        // `\u00XX` is a BYTE (the escaper's binary mode), not a code point.
+        assert_eq!(unescape_json_id(br#"a\u00e9b"#), b"a\xe9b");
+        // Above 0xFF is a real code point → UTF-8.
+        assert_eq!(unescape_json_id(br#"a\u20acb"#), "a\u{20ac}b".as_bytes());
+        // A surrogate pair combines into one code point.
+        assert_eq!(unescape_json_id(br#"\ud83d\ude00"#), "\u{1f600}".as_bytes());
+        // Unknown escapes and a trailing backslash stay verbatim.
+        assert_eq!(unescape_json_id(br#"a\qb"#), br#"a\qb"#);
+        assert_eq!(unescape_json_id(b"a\\"), b"a\\");
+    }
+
+    #[test]
+    fn scan_json_string_end_skips_escaped_quotes() {
+        // `a\"b"` (a, \, ", b, ") — the escaped quote does NOT terminate; the
+        // plain quote at index 4 does.
+        assert_eq!(scan_json_string_end(b"a\\\"b\"", 0), Some(4));
+        // No escape at all: the first quote terminates.
+        assert_eq!(scan_json_string_end(b"ab\"cd", 0), Some(2));
+        // Unterminated: the trailing backslash swallows the rest.
+        assert_eq!(scan_json_string_end(b"ab\\\"", 0), None);
+        // Escaped BACKSLASH then a terminator: `a\\"` = a, \, \, " → Some(3).
+        assert_eq!(scan_json_string_end(b"a\\\\\"", 0), Some(3));
+    }
+
     #[test]
     fn wire_format_matches_sign_cookie() {
         // The sealed token must be verifiable by the EXISTING cookie verify