[haskou]

Motivation

• The decryption path accepted attacker-controlled EncryptedPayload strings with no format or size validation, which allowed malformed input or very large base64 fields to trigger uncaught exceptions or large allocations before cryptographic authentication.
• The intent is to prevent availability and DoS issues by validating the payload early while preserving the existing decryption semantics for valid inputs.

Description

• Add strict validation in PrivateKey.decrypt() requiring exactly 4 dot-separated parts and performing per-field base64 checks.
• Enforce decoded-length checks for ephemeral public key (32 bytes), IV (12 bytes), and auth tag (16 bytes), and cap ciphertext size to 1 MiB before decryption.
• Implement a local decodeBase64 helper and keep the existing shared-secret derivation and AES-GCM decryption path intact.
• Add regression tests in tests/value-objects/crypto/PrivateKey.spec.ts for malformed payloads, invalid field lengths, and oversized ciphertext.

Testing

• Ran yarn test tests/value-objects/crypto/PrivateKey.spec.ts and the suite passed.
• The test run executed 1 test suite with 24 tests and all tests passed, including the new regression cases.

---

Supersedes #4.

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 824104682b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!