diff --git a/lib/src/main/java/com/auth0/jwt/impl/PayloadDeserializer.java b/lib/src/main/java/com/auth0/jwt/impl/PayloadDeserializer.java index 69df87a1..f5da7e7c 100644 --- a/lib/src/main/java/com/auth0/jwt/impl/PayloadDeserializer.java +++ b/lib/src/main/java/com/auth0/jwt/impl/PayloadDeserializer.java @@ -88,7 +88,13 @@ Instant getInstantFromSeconds(Map tree, String claimName) { "The claim '%s' value (%s) is out of the range representable as a NumericDate.", claimName, node.asText())); } - return Instant.ofEpochSecond(node.asLong()); + long seconds = node.asLong(); + if (seconds < Instant.MIN.getEpochSecond() || seconds > Instant.MAX.getEpochSecond()) { + throw new JWTDecodeException(String.format( + "The claim '%s' value (%s) is out of the range representable as a NumericDate.", + claimName, node.asText())); + } + return Instant.ofEpochSecond(seconds); } String getString(Map tree, String claimName) { diff --git a/lib/src/test/java/com/auth0/jwt/impl/PayloadDeserializerTest.java b/lib/src/test/java/com/auth0/jwt/impl/PayloadDeserializerTest.java index f734b572..a7dab3ae 100644 --- a/lib/src/test/java/com/auth0/jwt/impl/PayloadDeserializerTest.java +++ b/lib/src/test/java/com/auth0/jwt/impl/PayloadDeserializerTest.java @@ -269,6 +269,30 @@ public void shouldThrowOutOfRangeWhenNumericDateExceedsLong() { deserializer.getInstantFromSeconds(tree, "key"); } + @Test + public void shouldThrowOutOfRangeWhenNumericDateExceedsInstantRange() { + exception.expect(JWTDecodeException.class); + exception.expectMessage( + "The claim 'key' value (9223372036854775807) is out of the range representable as a NumericDate."); + + Map tree = new HashMap<>(); + tree.put("key", new LongNode(Long.MAX_VALUE)); + + deserializer.getInstantFromSeconds(tree, "key"); + } + + @Test + public void shouldThrowOutOfRangeWhenNumericDatePrecedesInstantRange() { + exception.expect(JWTDecodeException.class); + exception.expectMessage( + "The claim 'key' value (-9223372036854775808) is out of the range representable as a NumericDate."); + + Map tree = new HashMap<>(); + tree.put("key", new LongNode(Long.MIN_VALUE)); + + deserializer.getInstantFromSeconds(tree, "key"); + } + @Test public void shouldGetNullStringWhenParsingNullNode() { Map tree = new HashMap<>(); @@ -299,4 +323,4 @@ public void shouldGetStringWhenParsingTextNode() { assertThat(text, is("something here")); } -} \ No newline at end of file +}