Ruben FiszelandClaude Opus 4.8 efc62d8e78 fix: bound the guest PEM key length before decoding or storing ...

decoding_key_from_pem decoded an unbounded PEM: a well-formed key with an
oversized modulus passes the structural check, is stored in the unbounded TEXT
column, and is reparsed on every guest-JWT request. Refuse one longer than
MAX_GUEST_PEM_LEN (8 KiB) at the same choke point the save path validates
through, the way the JWKS URL is bounded. Also tighten two cap tests to assert
their specific error rather than a substring another cap shares.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VF3v6LA9399gNphmZaHYG3

2026-09-04 16:06:57 +02:00

..

examples

fix: enrich OTEL log records with per-request LogContext (#8812)

2026-04-13 21:50:50 +00:00

src

fix: bound the guest PEM key length before decoding or storing

2026-09-04 16:06:57 +02:00

tests

fix: let a principal without a login account own a draft (#10925)

2026-09-01 23:42:08 +02:00

Cargo.toml

fix: accept any PEM wrapping for the guest key, keep the public-key check

2026-09-04 10:30:46 +02:00