@@ -17,6 +17,11 @@ describe('GHSA-554w-wpv2-vw27 Security Patch', function() {
1717 return asn1 . toDer ( obj ) . getBytes ( ) ;
1818 }
1919
20+ beforeEach ( function ( ) {
21+ // check max depth is the default
22+ assert . equal ( asn1 . maxDepth , 256 ) ;
23+ } ) ;
24+
2025 it ( 'should throw a manageable error when default recursion depth is exceeded' , function ( ) {
2126 // create a payload just above the default limit (256)
2227 var DANGEROUS_DEPTH = 257 ;
@@ -41,6 +46,21 @@ describe('GHSA-554w-wpv2-vw27 Security Patch', function() {
4146 } , / A S N .1 p a r s i n g e r r o r : M a x d e p t h e x c e e d e d ./ ) ;
4247 } ) ;
4348
49+ it ( 'should still parse valid nested structures with new default limits' , function ( ) {
50+ var oldMaxDepth = asn1 . maxDepth ;
51+ asn1 . maxDepth = 258 ;
52+
53+ // create a payload just above the default limit (256)
54+ var DANGEROUS_DEPTH = 257 ;
55+ var der = createNestedDer ( DANGEROUS_DEPTH ) ;
56+ var buf = util . createBuffer ( der ) ;
57+
58+ // verify with new default depth
59+ asn1 . fromDer ( buf , { strict : true } ) ;
60+
61+ asn1 . maxDepth = oldMaxDepth ;
62+ } ) ;
63+
4464 it ( 'should still parse valid nested structures within default limits' , function ( ) {
4565 // verify we didn't break default depth functionality
4666 var SAFE_DEPTH = 20 ;
0 commit comments