Patched code sample

import base64
import sys

# This constant represents the core of the fix: a hard limit on the size of any
# single JWS/JWT segment (header or signature). The vulnerability existed
# because no such limit was enforced, allowing multi-megabyte segments to be
# passed to the resource-intensive base64 decoding and JSON parsing steps.
MAX_SEGMENT_LENGTH = 8192  # 8 KB is a reasonable limit

def create_malicious_token(header_payload_size):
    """
    Helper function to create a JWS-like string with an oversized header segment
    to simulate an attacker's payload.
    """
    # An attacker crafts a header that is excessively large.
    malicious_header_data = b'{"alg":"HS256","padding":"' + b'a' * header_payload_size + b'"}'
    
    # This encoding step creates a base64url string much larger than the limit.
    encoded_header = base64.urlsafe_b64encode(malicious_header_data).rstrip(b'=')
    
    # Dummy payload and signature are used to create a structurally valid token.
    dummy_payload = base64.urlsafe_b64encode(b'{"sub":"123"}').rstrip(b'=')
    dummy_signature = base64.urlsafe_b64encode(b'fakesignature').rstrip(b'=')
    
    return b'.'.join([encoded_header, dummy_payload, dummy_signature])

def verify_jws_with_size_limit(token_string):
    """
    This function represents the patched logic. It validates the size of each
    JWS segment *before* attempting to perform any costly operations like
    base64 decoding, which was the vector for the Denial of Service attack.
    """
    print(f"Received token of total size: {len(token_string) / 1024:.2f} KB")

    parts = token_string.split(b'.')
    # A JWS compact serialization must have 3 or 5 parts. We check for 3.
    if len(parts) != 3:
        raise ValueError("Invalid JWS format: must have 3 segments.")

    header_segment, payload_segment, signature_segment = parts

    # --- THE FIX ---
    # The following two checks are fast, low-cost operations that prevent the
    # vulnerability. They ensure that excessively large segments are rejected
    # immediately, before they can consume significant CPU and memory resources
    # in the decoding phase.
    
    if len(header_segment) > MAX_SEGMENT_LENGTH:
        raise ValueError(
            f"Validation failed: Header segment size ({len(header_segment)} bytes) "
            f"exceeds the limit of {MAX_SEGMENT_LENGTH} bytes."
        )
    
    if len(signature_segment) > MAX_SEGMENT_LENGTH:
        raise ValueError(
            f"Validation failed: Signature segment size ({len(signature_segment)} bytes) "
            f"exceeds the limit of {MAX_SEGMENT_LENGTH} bytes."
        )
    # --- END OF FIX ---

    print("SUCCESS: All JWS segments are within the allowed size limits.")
    
    # If the size checks pass, the application can now safely proceed with
    # the more resource-intensive decoding and verification steps.
    # For demonstration, we will not proceed with full verification.
    # e.g., header_data = base64.urlsafe_b64decode(header_segment + b'==')
    
    print("Verification can now safely proceed.")
    return True


if __name__ == "__main__":
    # --- DEMONSTRATION ---

    # Scenario 1: A valid, normal-sized token passes the check.
    print("--- 1. Testing a normal, valid token ---")
    normal_token = (
        b"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."
        b"eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ."
        b"SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
    )
    try:
        verify_jws_with_size_limit(normal_token)
        print("Result: Normal token was correctly processed.\n")
    except ValueError as e:
        print(f"Error: Normal token was unexpectedly rejected: {e}\n", file=sys.stderr)

    # Scenario 2: A malicious token with an oversized header is rejected.
    # The vulnerable code would try to base64-decode the entire huge header,
    # causing a Denial of Service. The fixed code rejects it instantly due to the size check.
    print("--- 2. Testing a malicious token with an oversized header ---")
    
    # Create a header payload that will result in a base64 segment larger than our limit.
    # 10 KB is larger than our 8 KB limit.
    malicious_size = 10 * 1024
    malicious_token = create_malicious_token(malicious_size)
    
    try:
        verify_jws_with_size_limit(malicious_token)
    except ValueError as e:
        # This is the expected, safe outcome for the malicious token.
        print(f"Result: Malicious token correctly rejected *before* expensive processing.")
        print(f"Reason: {e}")