Merge pull request #12 from Cysharp/fix-7

Fix #7, TryDecode supports invalid json format
Cysharp · Jan 28, 2022 · 0efd531 · 0efd531
2 parents 8e00be6 + d93a0ca
commit 0efd531
Show file tree

Hide file tree

Showing 2 changed files with 46 additions and 26 deletions.
diff --git a/src/LitJWT/Json/JsonReader.cs b/src/LitJWT/Json/JsonReader.cs
@@ -72,6 +72,8 @@ public JsonReader(ReadOnlySpan<byte> bytes, int offset)
 
         JsonParsingException CreateParsingException(string expected)
         {
+            if (bytes.Length == 0) return new JsonParsingException("expected:'" + expected + "' however buffer length is zero.");
+
             var actual = ((char)bytes[offset]).ToString();
             var pos = offset;
 

diff --git a/src/LitJWT/JwtDecoder.cs b/src/LitJWT/JwtDecoder.cs
@@ -17,6 +17,8 @@ public enum DecodeResult
         FailedVerifySignature,
         FailedVerifyExpire,
         FailedVerifyNotBefore,
+        InvalidHeaderFormat,
+        InvalidPayloadFormat,
     }
 
     public class JwtDecoder
@@ -275,20 +277,28 @@ public DecodeResult TryDecode<T>(ReadOnlySpan<char> token, PayloadParser<T> payl
                     return DecodeResult.InvalidBase64UrlHeader;
                 }
 
-                var reader = new JsonReader(bytes.Slice(0, bytesWritten));
-                var count = 0;
-                while (reader.ReadIsInObject(ref count))
+                try
                 {
-                    // try to read algorithm span.
-                    if (reader.ReadPropertyNameSegmentRaw().SequenceEqual(JwtConstantsUtf8.Algorithm))
-                    {
-                        algorithm = resolver.Resolve(reader.ReadStringSegmentRaw());
-                    }
-                    else
+                    var reader = new JsonReader(bytes.Slice(0, bytesWritten));
+                    var count = 0;
+                    while (reader.ReadIsInObject(ref count))
                     {
-                        reader.ReadNextBlock();
+                        // try to read algorithm span.
+                        if (reader.ReadPropertyNameSegmentRaw().SequenceEqual(JwtConstantsUtf8.Algorithm))
+                        {
+                            algorithm = resolver.Resolve(reader.ReadStringSegmentRaw());
+                        }
+                        else
+                        {
+                            reader.ReadNextBlock();
+                        }
                     }
                 }
+                catch (JsonParsingException)
+                {
+                    payloadResult = default;
+                    return DecodeResult.InvalidHeaderFormat;
+                }
             }
 
             // parsing payload.
@@ -307,26 +317,34 @@ public DecodeResult TryDecode<T>(ReadOnlySpan<char> token, PayloadParser<T> payl
 
                     var decodedPayload = bytes.Slice(0, bytesWritten);
 
-                    var reader = new JsonReader(decodedPayload);
-                    var count = 0;
-                    while (reader.ReadIsInObject(ref count))
+                    try
                     {
-                        // try to read algorithm span.
-                        var rawSegment = reader.ReadPropertyNameSegmentRaw();
-                        if (rawSegment.SequenceEqual(JwtConstantsUtf8.Expiration))
+                        var reader = new JsonReader(decodedPayload);
+                        var count = 0;
+                        while (reader.ReadIsInObject(ref count))
                         {
-                            expiry = reader.ReadInt64();
-                        }
-                        else if (rawSegment.SequenceEqual(JwtConstantsUtf8.NotBefore))
-                        {
-                            notBefore = reader.ReadInt64();
+                            // try to read algorithm span.
+                            var rawSegment = reader.ReadPropertyNameSegmentRaw();
+                            if (rawSegment.SequenceEqual(JwtConstantsUtf8.Expiration))
+                            {
+                                expiry = reader.ReadInt64();
+                            }
+                            else if (rawSegment.SequenceEqual(JwtConstantsUtf8.NotBefore))
+                            {
+                                notBefore = reader.ReadInt64();
+                            }
+                            else
+                            {
+                                reader.ReadNextBlock();
+                            }
                         }
-                        else
-                        {
-                            reader.ReadNextBlock();
-                        }
-                    }
 
+                    }
+                    catch (JsonParsingException)
+                    {
+                        payloadResult = default;
+                        return DecodeResult.InvalidPayloadFormat;
+                    }
                     // and custom deserialize.
                     payloadResult = payloadParser(decodedPayload);
                 }