Decompression of JWE with content fails

[mnylen]

Hey!

I noticed that compression/decompression does not work when passing arbitrary content instead of claims.

The compression is not done at all, but the zip field in the header is set, and while parsing encrypted content, I get io.jsonwebtoken.CompressionException: Decompression failed. Cause: incorrect header check

Sample code below:

public static void main(final String[] args) {
  var secretKey = Jwts.ENC.A128GCM.key().build();
  
  var encodedJwe = Jwts
    .builder()
    .content("hello, world!")
    .compressWith(Jwts.ZIP.DEF)
    .encryptWith(secretKey, Jwts.ENC.A128GCM)
    .compact();
  
  System.out.println("encodedJwe: " + encodedJwe);

  var decodedJwe = Jwts.parser().decryptWith(secretKey).build().parseEncryptedContent(encodedJwe);
  System.out.println("decodedJwe: " + decodedJwe);
}

Is this supposed to work? If not, maybe the builder shouldn't allow calling compact() if both content + compressWith are set, as this can produce unreadable JWEs.

In this example, the parseEncryptedContent() fails with this stack trace:

Exception in thread "main" io.jsonwebtoken.CompressionException: Decompression failed. Cause: incorrect header check
	at java.base/jdk.internal.reflect.DirectConstructorHandleAccessor.newInstance(DirectConstructorHandleAccessor.java:62)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:502)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:486)
	at io.jsonwebtoken.lang.Classes.instantiate(Classes.java:274)
	at io.jsonwebtoken.impl.lang.PropagatingExceptionFunction.apply(PropagatingExceptionFunction.java:69)
	at io.jsonwebtoken.impl.compression.AbstractCompressionAlgorithm.decompress(AbstractCompressionAlgorithm.java:143)
	at io.jsonwebtoken.impl.Payload.decompress(Payload.java:129)
	at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:592)
	at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:362)
	at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:94)
	at io.jsonwebtoken.impl.io.AbstractParser.parse(AbstractParser.java:36)
	at io.jsonwebtoken.impl.io.AbstractParser.parse(AbstractParser.java:29)
	at io.jsonwebtoken.impl.DefaultJwtParser.parseEncryptedContent(DefaultJwtParser.java:866)
        at ...
Caused by: java.util.zip.ZipException: incorrect header check
	at java.base/java.util.zip.InflaterInputStream.read(InflaterInputStream.java:181)
	at java.base/java.io.FilterInputStream.read(FilterInputStream.java:95)
	at io.jsonwebtoken.impl.compression.AbstractCompressionAlgorithm.doDecompress(AbstractCompressionAlgorithm.java:161)
	at io.jsonwebtoken.impl.compression.DeflateCompressionAlgorithm.doDecompress(DeflateCompressionAlgorithm.java:54)
	at io.jsonwebtoken.impl.compression.AbstractCompressionAlgorithm$4.apply(AbstractCompressionAlgorithm.java:85)
	at io.jsonwebtoken.impl.compression.AbstractCompressionAlgorithm$4.apply(AbstractCompressionAlgorithm.java:82)
	at io.jsonwebtoken.impl.lang.PropagatingExceptionFunction.apply(PropagatingExceptionFunction.java:57)
	... 9 more

[mnylen]

Can be worked around by manually compressing the content:

public static void main(final String[] args) {
  var secretKey = Jwts.ENC.A128GCM.key().build();

  var content = "hello, world!";
  final byte[] compressedContent;
  try (final var out = new ByteArrayOutputStream()) {
    try (final var def = Jwts.ZIP.DEF.compress(out)) {
      def.write(content.getBytes(StandardCharsets.UTF_8));
    }

     compressedContent = out.toByteArray();
  }

  var encodedJwe = Jwts
    .builder()
    .content(compressedContent)
    .compressWith(Jwts.ZIP.DEF)
    .encryptWith(secretKey, Jwts.ENC.A128GCM)
    .compact();

  System.out.println("encodedJwe: " + encodedJwe);

  var decodedJwe = Jwts.parser().decryptWith(secretKey).build().parseEncryptedContent(encodedJwe);
  System.out.println("decodedJwe: " + decodedJwe);
  System.out.println("decodedJwe.payload: " + new String(decodedJwe.getPayload(), StandardCharsets.UTF_8));
}

[mnylen]

Hmm-m. I don't find anywhere in the JWE spec (or from JJWT docs) that it says that this shouldn't be supported. I created a PR to fix this #937

[lhazlewood]

Created #938 to track this work against PR #937. Thanks for creating it!