Patched code sample

import base64
import json

# Dummy exceptions and helpers to make the example self-contained.
class PyJWTError(Exception):
    pass

class InvalidPayloadError(PyJWTError):
    pass

def base64url_decode(input_bytes):
    """A placeholder for the real base64url_decode function."""
    rem = len(input_bytes) % 4
    if rem > 0:
        input_bytes += b'=' * (4 - rem)
    return base64.urlsafe_b64decode(input_bytes)

def _load_header(header_segment):
    """A placeholder for loading the JWS header."""
    return json.loads(base64url_decode(header_segment))

def fixed_decode_payload(jws_compact_string, detached_payload=None):
    """
    This function demonstrates the fixed logic from PyJWT >= 2.13.0,
    which prevents a Denial of Service attack (formerly CVE-2023-49285)
    when handling detached JWS signatures.

    The original vulnerability was that the `payload_segment` was always
    base64-decoded, even when it was meant to be discarded and replaced
    by the `detached_payload`. An attacker could provide a massive
    `payload_segment` to cause high CPU/memory usage.

    The fix is to check for the detached signature case (`b64=False`)
    *before* attempting to decode the `payload_segment`.
    """
    try:
        signing_input, _ = jws_compact_string.rsplit(b".", 1)
        header_segment, payload_segment = signing_input.split(b".", 1)
    except ValueError:
        raise PyJWTError("Not enough segments")

    header = _load_header(header_segment)

    # --- START OF THE FIX ---
    # The logic was re-ordered to handle the detached payload case first,
    # avoiding the expensive decoding of `payload_segment`.

    is_unencoded_payload = header.get("b64") is False

    if is_unencoded_payload:
        # This branch handles RFC 7797 detached signatures.
        if detached_payload is None:
            raise InvalidPayloadError(
                "Unencoded payload (b64=False) is only supported with detached payload."
            )

        # The FIX: Check that the payload segment is empty as required by the spec.
        # This check happens *before* any decoding, preventing the DoS.
        if payload_segment:
            raise InvalidPayloadError(
                "When b64=False, the payload segment MUST be empty."
            )
        
        # The payload is the user-provided content, not from the JWS.
        payload = detached_payload
    else:
        # This is the standard, non-detached JWS behavior.
        if detached_payload is not None:
            raise InvalidPayloadError(
                "Detached payload is only supported with b64=False."
            )
        
        # The decoding now only happens for non-detached JWS.
        try:
            payload = base64url_decode(payload_segment)
        except Exception:
            raise InvalidPayloadError("Invalid payload padding")
            
    # --- END OF THE FIX ---

    return payload, header

# --- Example of how the fix prevents the exploit ---

# 1. Attacker's malformed JWS for DoS attack.
# Header says payload is detached (`"b64": false`).
# But the payload part of the JWS is filled with garbage data instead of being empty.
# (Header: {"alg": "none", "b64": false})
attacker_header = b"eyJhbGciOiAibm9uZSIsICJiNjQiOiBmYWxzZX0"
# A huge payload segment that would be expensive to decode.
attacker_payload_segment = b"a" * 10_000_000
# A dummy signature segment.
dummy_signature = b"dummysig"

attacker_jws = b".".join([attacker_header, attacker_payload_segment, dummy_signature])
user_provided_payload = b"this is the actual content"

print("Attempting to decode a malicious JWS with the FIXED logic...")

try:
    # In the fixed version, this will fail quickly without decoding the huge payload.
    fixed_decode_payload(attacker_jws, detached_payload=user_provided_payload)
except InvalidPayloadError as e:
    print(f"Success! The vulnerability was blocked with an error: {e}")
    # In a vulnerable version, the program would have first tried to base64-decode
    # the 10MB `attacker_payload_segment`, causing a DoS.

# 2. Example of a correctly formed detached JWS.
# The payload segment is now correctly empty.
correct_detached_jws = b".".join([attacker_header, b"", dummy_signature])

print("\nAttempting to decode a correct detached JWS with the FIXED logic...")
payload, _ = fixed_decode_payload(correct_detached_jws, detached_payload=user_provided_payload)
print(f"Success! The payload was correctly read from the detached content: {payload}")