unjwt 0.5.11 → 0.5.13

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.QRureeXk.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BvhKNVNR.mjs';
-export { i as utils } from './shared/unjwt.df8yQ5_5.mjs';
-export { j as jwk } from './shared/unjwt.Cz90HQhy.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.BRtnm5sB.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.B9sSOKE3.mjs';
+export { i as utils } from './shared/unjwt.Cay_cOOI.mjs';
+export { j as jwk } from './shared/unjwt.DtVML6Qp.mjs';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.Ce8yMcp_.mjs';
-export { j as jwe } from './shared/unjwt.DVMpKj8x.mjs';
-export { j as jwk } from './shared/unjwt.DuBBF25X.mjs';
-export { j as jws } from './shared/unjwt.D_JFPtpW.mjs';
-import './shared/unjwt.C_D0RMCp.mjs';
+export { i as utils } from './shared/unjwt.mBSKL6g4.mjs';
+export { j as jwe } from './shared/unjwt.UfthlTWt.mjs';
+export { j as jwk } from './shared/unjwt.CX8WRx20.mjs';
+export { j as jws } from './shared/unjwt.C6flzAeB.mjs';
+import './shared/unjwt.DFAKwqBz.mjs';

package/dist/jwe.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.CN1C8TlR.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BvhKNVNR.mjs';
+export { L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters } from './shared/unjwt.CN1C8TlR.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.B9sSOKE3.mjs';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DuBBF25X.mjs';
-import './shared/unjwt.Ce8yMcp_.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.DVMpKj8x.mjs';
-import './shared/unjwt.C_D0RMCp.mjs';
+import './shared/unjwt.CX8WRx20.mjs';
+import './shared/unjwt.mBSKL6g4.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.UfthlTWt.mjs';
+import './shared/unjwt.DFAKwqBz.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,2 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
-export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.Cz90HQhy.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.DtVML6Qp.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.Ce8yMcp_.mjs';
-export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.DuBBF25X.mjs';
+import './shared/unjwt.mBSKL6g4.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.CX8WRx20.mjs';

package/dist/jws.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.CN1C8TlR.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.QRureeXk.mjs';
+export { L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters } from './shared/unjwt.CN1C8TlR.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.BRtnm5sB.mjs';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DuBBF25X.mjs';
-import './shared/unjwt.Ce8yMcp_.mjs';
-import './shared/unjwt.C_D0RMCp.mjs';
-export { s as sign, v as verify } from './shared/unjwt.D_JFPtpW.mjs';
+import './shared/unjwt.CX8WRx20.mjs';
+import './shared/unjwt.mBSKL6g4.mjs';
+import './shared/unjwt.DFAKwqBz.mjs';
+export { s as sign, v as verify } from './shared/unjwt.C6flzAeB.mjs';

package/dist/shared/{unjwt.BvhKNVNR.d.mts → unjwt.B9sSOKE3.d.mts}

@@ -1,4 +1,4 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, H as JoseHeaderParameters, f as JWK_EC_Public, m as JWK, M as JWTClaimValidationOptions, I as JWTClaims } from './unjwt.CN1C8TlR.mjs';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, H as JoseHeaderParameters, f as JWK_EC_Public, m as JWK, M as JWTClaimValidationOptions, I as JWTClaims, L as JWT } from './unjwt.CN1C8TlR.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -176,10 +176,14 @@ type jwe_JWEEncryptOptions = JWEEncryptOptions;
 type jwe_JWEHeaderParameters = JWEHeaderParameters;
 type jwe_JWEKeyLookupFunction = JWEKeyLookupFunction;
 type jwe_JWEKeyManagementHeaderParameters = JWEKeyManagementHeaderParameters;
+declare const jwe_JWT: typeof JWT;
+declare const jwe_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
+declare const jwe_JWTClaims: typeof JWTClaims;
+declare const jwe_JoseHeaderParameters: typeof JoseHeaderParameters;
 declare const jwe_decrypt: typeof decrypt;
 declare const jwe_encrypt: typeof encrypt;
 declare namespace jwe {
-  export { jwe_decrypt as decrypt, jwe_encrypt as encrypt };
+  export { jwe_JWT as JWT, jwe_JWTClaimValidationOptions as JWTClaimValidationOptions, jwe_JWTClaims as JWTClaims, jwe_JoseHeaderParameters as JoseHeaderParameters, jwe_decrypt as decrypt, jwe_encrypt as encrypt };
   export type { jwe_JWEDecryptOptions as JWEDecryptOptions, jwe_JWEDecryptResult as JWEDecryptResult, jwe_JWEEncryptOptions as JWEEncryptOptions, jwe_JWEHeaderParameters as JWEHeaderParameters, jwe_JWEKeyLookupFunction as JWEKeyLookupFunction, jwe_JWEKeyManagementHeaderParameters as JWEKeyManagementHeaderParameters };
 }
 

package/dist/shared/{unjwt.QRureeXk.d.mts → unjwt.BRtnm5sB.d.mts}

@@ -1,4 +1,4 @@
-import { o as JWK_HMAC, p as JWK_RSA_SIGN, q as JWK_RSA_PSS, r as JWK_ECDSA, H as JoseHeaderParameters, m as JWK, n as JWKSet, M as JWTClaimValidationOptions, I as JWTClaims } from './unjwt.CN1C8TlR.mjs';
+import { o as JWK_HMAC, p as JWK_RSA_SIGN, q as JWK_RSA_PSS, r as JWK_ECDSA, H as JoseHeaderParameters, m as JWK, n as JWKSet, M as JWTClaimValidationOptions, I as JWTClaims, L as JWT } from './unjwt.CN1C8TlR.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -105,10 +105,14 @@ type jws_JWSProtectedHeader = JWSProtectedHeader;
 type jws_JWSSignOptions = JWSSignOptions;
 type jws_JWSVerifyOptions = JWSVerifyOptions;
 type jws_JWSVerifyResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> = JWSVerifyResult<T>;
+declare const jws_JWT: typeof JWT;
+declare const jws_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
+declare const jws_JWTClaims: typeof JWTClaims;
+declare const jws_JoseHeaderParameters: typeof JoseHeaderParameters;
 declare const jws_sign: typeof sign;
 declare const jws_verify: typeof verify;
 declare namespace jws {
-  export { jws_sign as sign, jws_verify as verify };
+  export { jws_JWT as JWT, jws_JWTClaimValidationOptions as JWTClaimValidationOptions, jws_JWTClaims as JWTClaims, jws_JoseHeaderParameters as JoseHeaderParameters, jws_sign as sign, jws_verify as verify };
   export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSKeyLookupFunction as JWSKeyLookupFunction, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
 }
 

package/dist/shared/{unjwt.D_JFPtpW.mjs → unjwt.C6flzAeB.mjs}

@@ -1,9 +1,12 @@
-import { i as importKey, g as getJWKFromSet } from './unjwt.DuBBF25X.mjs';
-import { a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.Ce8yMcp_.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.C_D0RMCp.mjs';
+import { i as importKey, g as getJWKFromSet } from './unjwt.CX8WRx20.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.mBSKL6g4.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.DFAKwqBz.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
+  const safeAdditionalHeader = sanitizeObject(
+    additionalProtectedHeader
+  );
   let { alg } = options;
   if (!alg) {
     if (isJWK(key) && key.alg) {
@@ -15,11 +18,11 @@ async function sign(payload, key, options = {}) {
   validateKeyLength(key, alg);
   const signingKey = await importKey(key, alg);
   const protectedHeader = {
-    ...additionalProtectedHeader,
-    ...isJWK(key) && key.kid ? { kid: additionalProtectedHeader?.kid || key.kid } : {},
+    ...safeAdditionalHeader,
+    ...isJWK(key) && key.kid ? { kid: safeAdditionalHeader?.kid || key.kid } : {},
     // Include kid if available
     alg,
-    typ: additionalProtectedHeader?.typ
+    typ: safeAdditionalHeader?.typ
   };
   applyTypCtyDefaults(protectedHeader, payload);
   if (protectedHeader.b64 === true) {
@@ -64,7 +67,9 @@ async function verify(jws, key, options = {}) {
   let protectedHeader;
   try {
     const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = JSON.parse(protectedHeaderString);
+    protectedHeader = sanitizeObject(
+      JSON.parse(protectedHeaderString)
+    );
   } catch (error_) {
     throw new Error(
       `Invalid JWS: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`

package/dist/shared/{unjwt.DuBBF25X.mjs → unjwt.CX8WRx20.mjs}

@@ -1,4 +1,4 @@
-import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, s as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.Ce8yMcp_.mjs';
+import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, s as sanitizeObject, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.mBSKL6g4.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -882,7 +882,7 @@ async function jwkTokey(jwk) {
     );
   }
   const { algorithm, keyUsages } = subtleMapping(jwk);
-  const keyData = { ...jwk };
+  const keyData = { ...sanitizeObject(jwk) };
   delete keyData.alg;
   delete keyData.use;
   return crypto.subtle.importKey(
@@ -1098,15 +1098,19 @@ async function importKey(key, alg) {
     return key;
   }
   if (isJWK(key)) {
-    if ("k" in key && typeof key.k === "string") {
-      return base64UrlDecode(key.k, false);
+    const safeJwk = sanitizeObject(key);
+    if ("k" in safeJwk && typeof safeJwk.k === "string") {
+      return base64UrlDecode(safeJwk.k, false);
     } else {
-      if (!key.alg && !alg) {
+      if (!safeJwk.alg && !alg) {
         throw new TypeError(
           "Algorithm must be provided when importing non-oct JWK"
         );
       }
-      return jwkTokey({ ...key, alg: key.alg || alg });
+      return jwkTokey({
+        ...safeJwk,
+        alg: safeJwk.alg || alg
+      });
     }
   }
   throw new Error("Invalid key type provided to importKey");
@@ -1114,7 +1118,7 @@ async function importKey(key, alg) {
 async function exportKey(key, jwk) {
   const exportedJwk = await keyToJWK(key);
   if (jwk) {
-    return { ...exportedJwk, ...jwk };
+    return { ...exportedJwk, ...sanitizeObject(jwk) };
   }
   return exportedJwk;
 }

package/dist/shared/{unjwt.df8yQ5_5.d.mts → unjwt.Cay_cOOI.d.mts}

@@ -50,6 +50,19 @@ declare function validateCriticalHeadersJWE(protectedHeader: {
     crit?: string[];
 } & Record<string, any>, understoodFromOptions?: string[]): void;
 
+/**
+ * Forked from unsecure@0.0.4
+ * Licensed under the MIT License.
+ *
+ * Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
+ */
+/**
+ * Remove prototype-pollution vectors from a plain record in-place.
+ * This strips __proto__, prototype, and constructor own properties.
+ * Returns the same reference for convenience.
+ */
+declare function sanitizeObject<T extends Record<string, unknown> | undefined>(obj: T): T;
+
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
 declare function base64Encode(data: Uint8Array<ArrayBuffer> | string): string;
@@ -91,6 +104,7 @@ declare const index_isJWKSet: typeof isJWKSet;
 declare const index_isJsonContent: typeof isJsonContent;
 declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
+declare const index_sanitizeObject: typeof sanitizeObject;
 declare const index_textDecoder: typeof textDecoder;
 declare const index_textEncoder: typeof textEncoder;
 declare const index_validateCriticalHeadersJWE: typeof validateCriticalHeadersJWE;
@@ -117,6 +131,7 @@ declare namespace index {
     index_isJsonContent as isJsonContent,
     index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
+    index_sanitizeObject as sanitizeObject,
     index_textDecoder as textDecoder,
     index_textEncoder as textEncoder,
     index_validateCriticalHeadersJWE as validateCriticalHeadersJWE,
@@ -125,4 +140,4 @@ declare namespace index {
   };
 }
 
-export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, applyTypCtyDefaults as n, isJsonContent as o, decodeMaybeJsonString as p, decodePayloadFromBytes as q, randomBytes as r, decodePayloadFromB64UrlSegment as s, textEncoder as t, getPlaintextBytes as u, computeJwtTimeClaims as v, validateJwtClaims as w, validateCriticalHeadersJWS as x, validateCriticalHeadersJWE as y };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, applyTypCtyDefaults as n, isJsonContent as o, decodeMaybeJsonString as p, decodePayloadFromBytes as q, randomBytes as r, decodePayloadFromB64UrlSegment as s, textEncoder as t, getPlaintextBytes as u, computeJwtTimeClaims as v, validateJwtClaims as w, validateCriticalHeadersJWS as x, validateCriticalHeadersJWE as y, sanitizeObject as z };

package/dist/shared/{unjwt.C_D0RMCp.mjs → unjwt.DFAKwqBz.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.DuBBF25X.mjs';
+import { c as checkSigCryptoKey } from './unjwt.CX8WRx20.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.Cz90HQhy.d.mts → unjwt.DtVML6Qp.d.mts}

@@ -1,4 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, H as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm } from './unjwt.CN1C8TlR.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, H as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims } from './unjwt.CN1C8TlR.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -153,6 +153,10 @@ declare const jwk_JWK_RSA_Public: typeof JWK_RSA_Public;
 declare const jwk_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
 declare const jwk_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
 declare const jwk_JWK_oct: typeof JWK_oct;
+declare const jwk_JWT: typeof JWT;
+declare const jwk_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
+declare const jwk_JWTClaims: typeof JWTClaims;
+declare const jwk_JoseHeaderParameters: typeof JoseHeaderParameters;
 declare const jwk_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
 declare const jwk_UnwrapKeyOptions: typeof UnwrapKeyOptions;
 declare const jwk_WrapKeyOptions: typeof WrapKeyOptions;
@@ -201,6 +205,10 @@ declare namespace jwk {
     jwk_JWK_RSA_SIGN as JWK_RSA_SIGN,
     jwk_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm,
     jwk_JWK_oct as JWK_oct,
+    jwk_JWT as JWT,
+    jwk_JWTClaimValidationOptions as JWTClaimValidationOptions,
+    jwk_JWTClaims as JWTClaims,
+    jwk_JoseHeaderParameters as JoseHeaderParameters,
     jwk_KeyManagementAlgorithm as KeyManagementAlgorithm,
     jwk_UnwrapKeyOptions as UnwrapKeyOptions,
     jwk_WrapKeyOptions as WrapKeyOptions,

package/dist/shared/{unjwt.DVMpKj8x.mjs → unjwt.UfthlTWt.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.DuBBF25X.mjs';
-import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.Ce8yMcp_.mjs';
-import { c as checkKeyLength } from './unjwt.C_D0RMCp.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.CX8WRx20.mjs';
+import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, s as sanitizeObject, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.mBSKL6g4.mjs';
+import { c as checkKeyLength } from './unjwt.DFAKwqBz.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);
@@ -183,10 +183,11 @@ async function normalizeKey(key, alg) {
     return key;
   }
   if (isJWK(key)) {
-    if ("k" in key && key.k) {
-      return base64UrlDecode(key.k, false);
+    const safeJwk = sanitizeObject(key);
+    if ("k" in safeJwk && safeJwk.k) {
+      return base64UrlDecode(safeJwk.k, false);
     }
-    return jwkTokey({ ...key, alg });
+    return jwkTokey({ ...safeJwk, alg });
   }
   throw new Error("unreachable");
 }
@@ -245,12 +246,12 @@ async function encrypt(payload, key, options = {}) {
   const baseProtectedHeader = { ...additionalProtectedHeader };
   delete baseProtectedHeader.alg;
   delete baseProtectedHeader.enc;
-  const jweProtectedHeader = {
+  const jweProtectedHeader = sanitizeObject({
     ...baseProtectedHeader,
     ...keyManagementHeaderParams,
     alg,
     enc
-  };
+  });
   const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
   const computedPayload = computeJwtTimeClaims(
     payload,
@@ -309,7 +310,9 @@ async function decrypt(jwe, key, options) {
   let protectedHeader;
   try {
     const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = JSON.parse(protectedHeaderJson);
+    protectedHeader = sanitizeObject(
+      JSON.parse(protectedHeaderJson)
+    );
   } catch (error_) {
     throw new Error(
       `Invalid JWE: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`

package/dist/shared/{unjwt.Ce8yMcp_.mjs → unjwt.mBSKL6g4.mjs}

@@ -20,7 +20,8 @@ function decodeMaybeJsonString(decodedString, header) {
     const looksLikeJson = decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]");
     if (looksLikeJson) {
       try {
-        return JSON.parse(decodedString);
+        const obj = JSON.parse(decodedString);
+        return sanitizeObject(obj);
       } catch {
       }
     }
@@ -193,6 +194,55 @@ function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
   }
 }
 
+const DANGEROUS_KEYS = ["__proto__", "prototype", "constructor"];
+function sanitizeObject(obj) {
+  if (!obj || typeof obj !== "object") return obj;
+  const seen = /* @__PURE__ */ new WeakSet();
+  visit(obj, seen);
+  return obj;
+}
+function visit(current, seen) {
+  if (!current || typeof current !== "object") return;
+  if (seen.has(current)) return;
+  seen.add(current);
+  for (const key of DANGEROUS_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(current, key)) {
+      try {
+        delete current[key];
+      } catch {
+      }
+      if (Object.prototype.hasOwnProperty.call(current, key)) {
+        try {
+          current[key] = void 0;
+          delete current[key];
+        } catch {
+        }
+      }
+      if (Object.prototype.hasOwnProperty.call(current, key)) {
+        try {
+          Object.defineProperty(current, key, {
+            value: void 0,
+            configurable: true,
+            enumerable: false,
+            writable: true
+          });
+          delete current[key];
+        } catch {
+        }
+      }
+    }
+  }
+  delete current["__proto__"];
+  delete current["prototype"];
+  delete current["constructor"];
+  if (Array.isArray(current)) {
+    for (const value of current) visit(value, seen);
+    return;
+  }
+  for (const k of Object.keys(current))
+    visit(current[k], seen);
+}
+
 const textEncoder = /* @__PURE__ */ new TextEncoder();
 const textDecoder = /* @__PURE__ */ new TextDecoder();
 function base64Encode(data) {
@@ -288,6 +338,7 @@ const index = {
   isJsonContent: isJsonContent,
   maybeArray: maybeArray,
   randomBytes: randomBytes,
+  sanitizeObject: sanitizeObject,
   textDecoder: textDecoder,
   textEncoder: textEncoder,
   validateCriticalHeadersJWE: validateCriticalHeadersJWE,
@@ -295,4 +346,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, base64Encode as s, textEncoder as t, maybeArray as u, validateCriticalHeadersJWS as v, isCryptoKeyPair as w, isJsonContent as x, decodeMaybeJsonString as y };
+export { isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isJsonContent as y, decodeMaybeJsonString as z };

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
 import './shared/unjwt.CN1C8TlR.mjs';
-export { n as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, v as computeJwtTimeClaims, f as concatUint8Arrays, p as decodeMaybeJsonString, s as decodePayloadFromB64UrlSegment, q as decodePayloadFromBytes, u as getPlaintextBytes, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, o as isJsonContent, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder, y as validateCriticalHeadersJWE, x as validateCriticalHeadersJWS, w as validateJwtClaims } from './shared/unjwt.df8yQ5_5.mjs';
+export { n as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, v as computeJwtTimeClaims, f as concatUint8Arrays, p as decodeMaybeJsonString, s as decodePayloadFromB64UrlSegment, q as decodePayloadFromBytes, u as getPlaintextBytes, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, o as isJsonContent, m as maybeArray, r as randomBytes, z as sanitizeObject, a as textDecoder, t as textEncoder, y as validateCriticalHeadersJWE, x as validateCriticalHeadersJWS, w as validateJwtClaims } from './shared/unjwt.Cay_cOOI.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, s as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, y as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, m as isCryptoKey, w as isCryptoKeyPair, a as isJWK, g as isJWKSet, x as isJsonContent, u as maybeArray, r as randomBytes, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.Ce8yMcp_.mjs';
+export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, z as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, y as isJsonContent, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.mBSKL6g4.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.11",
+  "version": "0.5.13",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",