Prevent mutation of supp_pub.protected in to_cis.

cwt/utils.py

@@ -1,4 +1,5 @@
 import base64
+import copy
 import json
 from typing import Any, Dict, List, Optional, Union
 
@@ -150,7 +151,7 @@ def to_cis(context: Dict[str, Any], recipient_alg: Optional[int] = None) -> List
         if "protected" in context["supp_pub"]:
             if not isinstance(context["supp_pub"]["protected"], dict):
                 raise ValueError("supp_pub.protected should be dict.")
-            protected = to_cose_header(context["supp_pub"]["protected"])
+            protected = to_cose_header(copy.deepcopy(context["supp_pub"]["protected"]))
             supp_pub[1] = cbor2.dumps(protected)
         if "other" in context["supp_pub"]:
             if not isinstance(context["supp_pub"]["other"], str):

tests/test_recipient.py

@@ -293,6 +293,22 @@ def test_recipient_new_with_invalid_arg(self, protected, unprotected, msg):
             pytest.fail("Recipient() should fail.")
         assert msg in str(err.value)
 
+    def test_recipient_new_does_not_modify_protected(self, rpk1, rsk1):
+        protected = {}
+        unprotected = {"alg": "ECDH-ES+A128KW"}
+        kdf_context = {
+            "alg": "A128KW",
+            "supp_pub": {
+                "key_data_length": 128,
+                "protected": protected,
+                "other": "test",
+            },
+        }
+        _ = Recipient.new(
+            protected=protected, unprotected=unprotected, sender_key=rsk1, recipient_key=rpk1, context=kdf_context
+        )
+        assert protected == {}
+
     def test_recipient_from_jwk_with_str(self):
         recipient = Recipient.new(unprotected={"alg": "direct"})
         assert isinstance(recipient, RecipientInterface)