fix(isJWT): replace Buffer.from with cross-env decode helper; add unsecured JWT valid test

Author: Kartikeya-guthub

src/lib/isJWT.js

@@ -1,13 +1,40 @@
 import assertString from './util/assertString';
 import isBase64 from './isBase64';
 
+function decodeBase64Url(b64) {
+  if (typeof Buffer !== 'undefined') {
+    if (typeof Buffer.from === 'function') {
+      return Buffer.from(b64, 'base64').toString('utf8');
+    }
+    // eslint-disable-next-line no-buffer-constructor
+    return new Buffer(b64, 'base64').toString('utf8');
+  }
+  if (typeof atob === 'function') {
+    const binary = atob(b64);
+    if (typeof TextDecoder !== 'undefined') {
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0; i < binary.length; i += 1) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return new TextDecoder('utf-8').decode(bytes);
+    }
+    let encoded = '';
+    for (let i = 0; i < binary.length; i += 1) {
+      const code = binary.charCodeAt(i).toString(16).padStart(2, '0');
+      encoded += `%${code}`;
+    }
+    return decodeURIComponent(encoded);
+  }
+  return b64;
+}
+
 function tryDecodeJSON(segment) {
   if (!isBase64(segment, { urlSafe: true })) return false;
   try {
     // Normalize base64url alphabet to base64, then restore stripped padding
     let b64 = segment.replace(/-/g, '+').replace(/_/g, '/');
     while (b64.length % 4) b64 += '=';
-    const decoded = Buffer.from(b64, 'base64').toString('utf8');
+    const decoded = decodeBase64Url(b64);
     const parsed = JSON.parse(decoded);
     if (typeof parsed !== 'object') return false;
     if (parsed === null) return false;

test/validators.test.js

@@ -5542,6 +5542,7 @@ describe('Validators', () => {
         'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJsb3JlbSI6Imlwc3VtIn0.ymiJSsMJXR6tMSr8G9usjQ15_8hKPDv_CArLhxw28MI',
         'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJkb2xvciI6InNpdCIsImFtZXQiOlsibG9yZW0iLCJpcHN1bSJdfQ.rRpe04zbWbbJjwM43VnHzAboDzszJtGrNsUxaqQ-GQ8',
         'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqb2huIjp7ImFnZSI6MjUsImhlaWdodCI6MTg1fSwiamFrZSI6eyJhZ2UiOjMwLCJoZWlnaHQiOjI3MH19.YRLPARDmhGMC3BBk_OhtwwK21PIkVCqQe8ncIRPKo-E',
+        'eyJhbGciOiJub25lIn0.eyJpc3MiOiJqb2UiLCJleHAiOjEzMDA4MTkzODAsImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.',
       ],
       invalid: [
         'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9',