Catch longer JWT segment lengths

[rgmz]

Description:

This fixes #1207. Ideally, it would be merged after #1215 so the pattern can be made case sensitive.

Checklist:

• Does your PR pass tests?
• Have you written new tests for your changes?
• Have you lint your code locally prior to submission?

[willlindsey05]

I just encountered a case where the payload length was 756. Any chance to making the max payload length 1000.

[rgmz]

I just encountered a case where the payload length was 756. Any chance to making the max payload length 1000.

I bumped up the length for each section even further, just to be sure.

@zricethezav any thoughts on this change?

[rgmz]

I bumped up the length for each section even further, just to be sure.

I've since found JWTs that are even longer than 1,000 characters, which is the highest number of repetitions you can specify.

In light of this, I've updated this to remove the limit on repetitions. I feel that the pattern is niche enough that this is unlikely to introduce false-positives; I tested this against a large internal GitHub instance and did not get any.

[zricethezav]

I've since found JWTs that are even longer than 1,000 characters, which is the highest number of repetitions you can specify. In light of this, I've updated this to remove the limit on repetitions. I feel that the pattern is niche enough that this is unlikely to introduce false-positives; I tested this against a large internal GitHub instance and did not get any.

I wonder if https://github.com/wasilibs/go-re2 has a limitation on 1,000 characters o.O. Switching to this library for regex is something I'm considering

[zricethezav]

Thanks for another stellar contribution @rgmz, I'll look into the go-re2 library soon