Capped buffer expansion

UnitTests/SecurityVulnerabilitiesTest.cs

@@ -63,7 +63,7 @@ public void InvalidCurveAttack(string keyImplementation)
             byte[] y = Base64Url.Decode("e8lnCO-AlStT-NJVX-crhB7QRYhiix03illJOVAOyck");
             byte[] d = Base64Url.Decode("VEmDZpDXXK8p8N0Cndsxs924q6nS1RXFASRl6BfUqdw");
 
-            var privateKey = keyImplementation == "CNG" ? (object) EccKey.New(x, y, d, usage: CngKeyUsages.KeyAgreement) : EcdhKey.New(x, y, d) ;
+            var privateKey = keyImplementation == "CNG" ? (object)EccKey.New(x, y, d, usage: CngKeyUsages.KeyAgreement) : EcdhKey.New(x, y, d);
 
             //JWT encrypted with attacker private key, which is equals to (reciever_pk mod 113)
             var attackMod113 =
@@ -171,7 +171,7 @@ public void BitLengthIntegerOverflow()
             }
         }
 
-	[Fact]
+        [Fact]
         public void DeflateBomb()
         {
             // given
@@ -197,15 +197,8 @@ public void DeflateBomb()
             string bomb = Jose.JWT.Encode(payload, publicKey, JweAlgorithm.RSA_OAEP, JweEncryption.A256GCM, JweCompression.DEF);
 
             // when
-            try
-            {
-                string decoded = Jose.JWT.Decode(bomb, privateKey, JwsAlgorithm.RS256);
-                Assert.True(false, "Should fail with NotSupportedException");
-            }
-            catch (JoseException e)
-            {
-                Console.Out.WriteLine(e.ToString());
-            }
+            Exception thrownException = Assert.Throws<JoseException>(() => Jose.JWT.Decode(bomb, privateKey));
+            Assert.IsType<NotSupportedException>(thrownException.InnerException);
         }
 
         [Fact]
@@ -217,7 +210,7 @@ public void TruncatedGcmAuthTag()
             try
             {
                 // when decrypt token with trunated AES GCM tag, it should fail
-                Jose.JWT.Decode(token, aes128Key);  
+                Jose.JWT.Decode(token, aes128Key);
                 Assert.True(false, "Should fail with IntegrityException");
 
             }

jose-jwt/compression/CappedMemoryStream.cs

@@ -0,0 +1,34 @@
+using System;
+using System.IO;
+
+namespace Jose;
+
+public class CappedMemoryStream : MemoryStream
+{
+    private readonly long maxCapacity;
+
+    public CappedMemoryStream(long maxCapacity)
+    {
+        this.maxCapacity = maxCapacity;
+    }
+
+    public override void Write(byte[] buffer, int offset, int count)
+    {
+        if (Length + Math.Min(count, buffer.Length - offset) > maxCapacity)
+        {
+            throw new NotSupportedException("Exceeding maximum memory stream size.");
+        }
+
+        base.Write(buffer, offset, count);
+    }
+
+    public override void WriteByte(byte value)
+    {
+        if (Length + 1 > maxCapacity)
+        {
+            throw new NotSupportedException("Exceeding maximum memory stream size.");
+        }
+
+        base.WriteByte(value);
+    }
+}

jose-jwt/compression/DeflateCompression.cs

@@ -28,24 +28,22 @@ public byte[] Compress(byte[] plainText)
 
         public byte[] Decompress(byte[] compressedText)
         {
-            byte[] buffer = new byte[maxBufferSizeBytes];
-
             try
             {
-                using (MemoryStream ms = new MemoryStream(buffer))
+                using (MemoryStream ms = new CappedMemoryStream(maxBufferSizeBytes))
                 {
                     using (MemoryStream compressedStream = new MemoryStream(compressedText))
                     {
                         using (DeflateStream deflater = new DeflateStream(compressedStream, CompressionMode.Decompress))
                         {
                             deflater.CopyTo(ms);
                         }
-                    }
-
-                    return Arrays.Truncate(ms.ToArray(), ms.Position);
+                    }
+
+                    return ms.ToArray();
                 }
             }
-            catch(NotSupportedException e)
+            catch (NotSupportedException e)
             {
                 throw new JoseException("Unable to deflate compressed payload, most likely exceeded decompression buffer size.", e);
             }