Re-evaluate usage of Utf8JsonReader.ValueSpan for property name equality via SequenceEqual of raw bytes about jwt HOT 3 CLOSED

Generally speaking, getting the raw bytes via ValueSpan and then using SequenceEqual probably isn't what you want to do unless you control the input or only want to support the exact bytes.

I want to support the exact match as the propertie names are registred values.
But...
as defined in the JWS RFC,

For security reasons, the representations of these names must be compared verbatim after performing any escape processing

So I have to support escaped properties.
The properties detection may be rewrite with ValueTextEqual instead of bytes comparison as proposed.

Also, is the JSON input here trusted or known to be valid UTF-8?

The JSON input is not trusted at all. Even if there is a signature validation, we have to read a part of the JSON before.

It should be a valid UTF-8 encoded string, but it may be a malicious string.
Do you have any example of malformed UTF-8 that may cause security issue?

from jwt.

It should be a valid UTF-8 encoded string, but it may be a malicious string.

What do you mean by malicious?

Do you have any example of malformed UTF-8 that may cause security issue?

I don't know. I would assume yes. Within the context of matching for equality on known utf8 bytes, it shouldn't matter.

from jwt.

Fixed by #325

from jwt.