Insecure handling of padding during JWE decryption

[mtruscello]

The logic for padding removal from JWE encryption is incorrect. The current code merely strips unprintable characters regardless if they belong to the padding or not:

client-encryption-python/client_encryption/jwe_encryption.py

Line 99 in 5f8ecef

decoded_payload = ''.join(c for c in decrypted.decode() if c.isprintable())

For AES GCM this isn't an issue because the padding removal is handled automatically.
For modes that do care about padding (e.g. AES CBC) this is blindly removing characters under the assumption that A) they belong to the padding and B) that the padding is valid. This allows an attacker to spoof data much more easily because the padding is never validated and invalid JSON characters are being silently removed.

The pycryptodome library that this package uses contains padding utilities. I strongly recommend you use them.

[NehaSony]

Hi @mtruscello
Thanks for reporting this. This should be available in the next versions onwards.