Patched code sample

import sys

# Helper classes to simulate the joserfc environment
class JWSRegistry:
    """Simulates the joserfc registry with a configurable size limit."""
    def __init__(self, max_payload_length=None):
        self.max_payload_length = max_payload_length

class ExceededSizeError(ValueError):
    """Simulates the error raised for oversized payloads."""
    def __init__(self, part):
        super().__init__(f"Exceeded max size for: {part}")

def process_unencoded_jws_payload(protected_header, payload, registry):
    """
    This function represents the fixed logic for handling RFC7797 ("b64": false)
    JWS payloads, as implemented in joserfc version 1.6.7 and later.

    It ensures that detached payloads are checked against the configured
    `max_payload_length` to prevent resource exhaustion.
    """
    if protected_header.get("b64") is False:
        # THE FIX: This check was missing in vulnerable versions for unencoded
        # (b64=false) payloads. It prevents resource exhaustion by rejecting
        # oversized payloads early.
        if registry.max_payload_length and len(payload) > registry.max_payload_length:
            raise ExceededSizeError("payload")

        # If the check passes, the payload can be safely processed.
        print(f"Payload of size {len(payload)} accepted for processing.")
        return payload
    return None

# --- Demonstration of the fix ---

# 1. Configure a registry with a small payload size limit for the demo.
# In a real application, this might be several megabytes.
registry = JWSRegistry(max_payload_length=100)

# 2. Define the protected header for an unencoded JWS payload (RFC7797).
protected_header = {"alg": "HS256", "b64": False}

# 3. Create a payload that is too large.
large_payload = b'A' * 200

print(f"Attempting to process payload of size {len(large_payload)} with a limit of {registry.max_payload_length}...")

try:
    # This call will fail because the payload is larger than the allowed limit.
    # In vulnerable versions, this check was skipped, and the large payload
    # would be passed on, risking resource exhaustion.
    process_unencoded_jws_payload(protected_header, large_payload, registry)
except ExceededSizeError as e:
    print(f"SUCCESS: The fix correctly rejected the oversized payload with error: {e}")

# 4. Create a payload that is within the limit.
small_payload = b'A' * 50
print(f"\nAttempting to process payload of size {len(small_payload)} with a limit of {registry.max_payload_length}...")
try:
    # This call will succeed as the payload size is valid.
    process_unencoded_jws_payload(protected_header, small_payload, registry)
except ExceededSizeError as e:
    print(f"FAILURE: The fix incorrectly rejected a valid payload: {e}")