perf(signer): early exit on missing delimiter in unsign to avoid redundant HMAC calculations

signer.js

@@ -57,8 +57,16 @@ function _unsign (signedValue, secrets, algorithm) {
   if (typeof signedValue !== 'string') {
     throw new TypeError('Signed cookie string must be provided.')
   }
-  const value = signedValue.slice(0, signedValue.lastIndexOf('.'))
-  const actual = Buffer.from(signedValue.slice(signedValue.lastIndexOf('.') + 1))
+  const dotIndex = signedValue.lastIndexOf('.')
+  if (dotIndex === -1 || dotIndex === signedValue.length - 1) {
+    return {
+      valid: false,
+      renew: false,
+      value: null
+    }
+  }
+  const value = signedValue.slice(0, dotIndex)
+  const actual = Buffer.from(signedValue.slice(dotIndex + 1))
 
   for (let i = 0; i < secrets.length; ++i) {
     const secret = secrets[i]

test/signer.test.js

@@ -30,15 +30,18 @@ describe('default', () => {
   })
 
   test('signer.unsign', (t) => {
-    t.plan(4)
+    t.plan(7)
 
     const input = signer.sign('some-value', secret)
     const result = signer.unsign(input)
 
     t.assert.strictEqual(result.valid, true)
     t.assert.strictEqual(result.renew, false)
     t.assert.strictEqual(result.value, 'some-value')
+    t.assert.deepStrictEqual(signer.unsign('unsigned-string-without-dot'), { valid: false, renew: false, value: null })
+    t.assert.deepStrictEqual(signer.unsign('string-ending-with-dot.'), { valid: false, renew: false, value: null })
     t.assert.throws(() => signer.unsign(undefined), err => err.message === 'Signed cookie string must be provided.')
+    t.assert.throws(() => signer.unsign(null), err => err.message === 'Signed cookie string must be provided.')
   })
 
   test('unsign', (t) => {