tokens: typed.go ASN.1 decoders accept trailing bytes and have no fuzz target

[Effi-S]

Fixes #2189

Summary

typed.go's ASN.1 decoders discard asn1.Unmarshal's rest return value, so any number of trailing bytes appended after a validly-encoded token or metadata payload are silently accepted rather than rejected — the classic ASN.1 malleability pattern: two distinct byte strings decode to the same value. Neither decoder has a FuzzXxx target, which AGENTS.md mandates for any exported function that parses untrusted/attacker-controlled bytes; every sibling ASN.1 decoder in the repo (token/core/common/encoding/asn1, token/core/fabtoken/..., token/core/zkatdlog/...) already has one.

Where

token/services/tokens/typed.go — UnmarshalTypedToken (~line 31) and UnmarshalTypedMetadata (~line 65) each call asn1.Unmarshal(raw, &typed) and check only the returned error, ignoring the rest []byte return that reports unconsumed trailing bytes.

Impact

A byte string X and X + arbitrary trailer are treated as identical tokens/metadata by every caller of these two functions. Depending on where the raw bytes originate (any wire format that carries a typed token/metadata payload), this is a substrate for hash/signature-mismatch or replay-style confusion between two representations that "look the same" to this decoder but differ byte-for-byte.

Reproduction

valid, _ := tokens.WrapWithType(7, driver.Token("payload"))
withTrailer := append(append([]byte{}, valid...), 0x00, 0x01, 0x02)

want, _ := tokens.UnmarshalTypedToken(valid)
got, err := tokens.UnmarshalTypedToken(withTrailer)

require.NoError(t, err, "trailing bytes after a valid encoding should be rejected, not silently accepted")
require.Equal(t, want, got, "a valid encoding and the same encoding with an arbitrary trailer decode to the same TypedToken")

=== RUN   TestUnmarshalTypedToken_AcceptsTrailingBytes
--- PASS: TestUnmarshalTypedToken_AcceptsTrailingBytes (0.00s)
=== RUN   TestUnmarshalTypedMetadata_AcceptsTrailingBytes
--- PASS: TestUnmarshalTypedMetadata_AcceptsTrailingBytes (0.00s)
PASS

Both tests pass — i.e., the trailing-byte acceptance is confirmed present on current main. (A FuzzUnmarshalTypedTokenNoPanic/FuzzUnmarshalTypedMetadataNoPanic pair, seeded with valid/empty/truncated/valid+trailer inputs, also ran clean for 20s with no panics — the decoders don't crash on malformed input, they just accept more than they should.)

Severity

Medium — a real ASN.1 malleability bug with no panic/crash component, but no fuzz coverage either, on functions that parse externally-sourced bytes.