Re: [PR] [FIX] JWT should not attempt to unzip data by default [james-project]

2024-04-09 Thread via GitHub
Arsnael merged PR #2189: URL: https://github.com/apache/james-project/pull/2189 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail:

Re: [PR] [FIX] JWT should not attempt to unzip data by default [james-project]

2024-04-07 Thread via GitHub
quantranhong1999 commented on PR #2189: URL: https://github.com/apache/james-project/pull/2189#issuecomment-2041756088 Nothing to add -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific

Re: [PR] [FIX] JWT should not attempt to unzip data by default [james-project]

2024-04-07 Thread via GitHub
ottoka commented on code in PR #2189: URL: https://github.com/apache/james-project/pull/2189#discussion_r1555083407 ## server/protocols/jwt/src/main/java/org/apache/james/jwt/JwtTokenVerifier.java: ## @@ -25,16 +25,36 @@ import org.slf4j.Logger; import

[PR] [FIX] JWT should not attempt to unzip data by default [james-project]

2024-04-07 Thread via GitHub
chibenwa opened a new pull request, #2189: URL: https://github.com/apache/james-project/pull/2189 jjwt support zip by default yet uncompression of untrusted data can result in excessive memory/cpu usage for special crafted malicious payload. -- This is an automated message from the