jose 6.2.14 → 6.2.16

package/dist/webapi/jwe/general/decrypt.js

@@ -13,9 +13,10 @@ async function generalDecrypt(jwe, key, options) {
     throw new JWEInvalid("JWE Recipients missing or incorrect type");
   if (!recipients.length)
     throw new JWEInvalid("JWE Recipients has no members");
-  let shared, sharedJwe, token;
+  const shared = prepareDecrypt(options);
+  let sharedJwe, token;
   try {
-    shared = prepareDecrypt(options), sharedJwe = snapshotSharedJWE(jwe), token = shareJWE(sharedJwe);
+    sharedJwe = snapshotSharedJWE(jwe), token = shareJWE(sharedJwe);
   } catch {
     throw new JWEDecryptionFailed();
   }

package/dist/webapi/jwks/remote.js

@@ -5,7 +5,7 @@ function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 let USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.14");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.16");
 const customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {
@@ -31,6 +31,8 @@ function isFreshFor(timestamp, duration) {
 function validateDuration(value, fallback, option) {
   if (Number.isNaN(value))
     throw new TypeError(`"${option}" option must not be NaN`);
+  if (typeof value == "number" && value < 0)
+    throw new TypeError(`"${option}" option must not be negative`);
   return typeof value == "number" ? value : fallback;
 }
 function createRemoteJWKSet(url, options) {

package/dist/webapi/jws/general/verify.js

@@ -22,15 +22,9 @@ async function generalVerify(jws, key, options) {
   const signatureEntries = Array.from(signatures);
   if (!signatureEntries.every(isObject))
     throw new JWSInvalid("JWS Signatures missing or incorrect type");
-  let shared;
-  try {
-    if (inputPayload === void 0)
-      throw new Error();
-    shared = prepareVerify(options);
-  } catch {
+  if (inputPayload === void 0)
     throw new JWSSignatureVerificationFailed();
-  }
-  const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload, candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
+  const shared = prepareVerify(options), payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload, candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
   let payloadEncodings = 0;
   for (const [, , payloadEncoding] of candidates)
     if (payloadEncodings |= payloadEncoding, payloadEncodings === 3)

package/dist/webapi/lib/deflate.js

@@ -23,7 +23,8 @@ async function transform(stream, input, maxLength = 1 / 0) {
     if (done)
       break;
     if (chunks.push(value), length += value.byteLength, maxLength !== 1 / 0 && length > maxLength)
-      throw new JWEInvalid("Decompressed plaintext exceeded the configured limit");
+      throw await reader.cancel().catch(() => {
+      }), new JWEInvalid("Decompressed plaintext exceeded the configured limit");
   }
   return concat(...chunks);
 }

package/dist/webapi/lib/jwe_decrypt.js

@@ -1,7 +1,7 @@
 import { decrypt, generateCek } from "./content_encryption.js";
 import { decodeBase64url, encodeAsciiMember, parseJoseHeader, isDisjoint, isObject, validateCrit, validateAlgorithms, JWE_RECOGNIZED } from "./validate.js";
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from "../util/errors.js";
-import { decryptKeyManagement } from "./key_management.js";
+import { decryptKeyManagement, validateMaxPBES2Count } from "./key_management.js";
 import { decoder } from "./buffer_utils.js";
 import { prepareKey } from "./key.js";
 import { JWE, isJWECEKTransport, jweAlgorithm, jweEncryption } from "./jwe_algorithms.js";
@@ -69,12 +69,17 @@ function shareJWE(jwe) {
   ];
 }
 function prepareDecrypt(options) {
+  const keyManagementAlgorithms = options && validateAlgorithms("keyManagementAlgorithms", options.keyManagementAlgorithms), contentEncryptionAlgorithms = options && validateAlgorithms("contentEncryptionAlgorithms", options.contentEncryptionAlgorithms), { crit, maxPBES2Count, maxDecompressedLength } = options ?? {};
+  validateMaxPBES2Count(maxPBES2Count);
+  const decompressionLimit = maxDecompressedLength ?? 25e4;
+  if (decompressionLimit !== 0 && decompressionLimit !== 1 / 0 && (!Number.isSafeInteger(decompressionLimit) || decompressionLimit < 1))
+    throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");
   return [
-    options && validateAlgorithms("keyManagementAlgorithms", options.keyManagementAlgorithms),
-    options && validateAlgorithms("contentEncryptionAlgorithms", options.contentEncryptionAlgorithms),
-    options?.crit,
-    options?.maxPBES2Count,
-    options?.maxDecompressedLength
+    keyManagementAlgorithms,
+    contentEncryptionAlgorithms,
+    crit,
+    maxPBES2Count,
+    maxDecompressedLength
   ];
 }
 async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
@@ -145,8 +150,6 @@ async function decryptJWE(jwe, shared, key, token = shareJWE(jwe)) {
     const decompressionLimit = maxDecompressedLength ?? 25e4;
     if (decompressionLimit === 0)
       throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
-    if (decompressionLimit !== 1 / 0 && (!Number.isSafeInteger(decompressionLimit) || decompressionLimit < 1))
-      throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");
     plaintext = await decompress(plaintext, decompressionLimit).catch((cause) => {
       throw cause instanceof JWEInvalid ? cause : new JWEInvalid("Failed to decompress plaintext", { cause });
     });

package/dist/webapi/lib/jwt_claims_set.js

@@ -77,7 +77,8 @@ function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
       throw new TypeError("Invalid clockTolerance option type");
     tolerance = clockTolerance;
   }
-  validateInput("clockTolerance option", tolerance);
+  if (validateInput("clockTolerance option", tolerance), tolerance < 0)
+    throw new TypeError("Invalid clockTolerance option input");
   const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(claimsSet, "nbf");
   if (nbf !== void 0 && nbf > now + tolerance)
     throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', claimsSet, "nbf", checkFailed);

package/dist/webapi/lib/key_management.js

@@ -111,7 +111,6 @@ async function decryptKeyManagement(entry, enc, key, encryptedKey, joseHeader, m
     case "PBKDF2": {
       if (typeof joseHeader.p2c != "number")
         throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) missing or invalid');
-      validateMaxPBES2Count(maxPBES2Count);
       const p2cLimit = maxPBES2Count ?? 1e4;
       if (joseHeader.p2c > p2cLimit)
         throw new JWEInvalid('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.14",
+  "version": "6.2.16",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",