mirrors/hermes-agent
1
0
Fork 0
mirror of https://github.com/NousResearch/hermes-agent.git synced 2026-07-21 16:18:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

test(webhook): cover the Svix v1 branch in the non-ASCII signature regression

Browse source 
The fix routes the Svix v1 comparison through _hmac_str_equal too, but the
existing non-ASCII tests only exercised the GitHub/GitLab/generic V1/V2
branches. Add a Svix case (valid svix-id + fresh svix-timestamp so it
reaches the v1,<sig> compare) with a non-ASCII signature, which raised
TypeError before the fix and now rejects cleanly.
This commit is contained in:
Drexuxux 2026-07-16 15:14:48 +03:00 • committed by Teknium
parent 1b69c47e97
commit 4ccb232af9
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
tests/gateway/test_webhook_adapter.py
View file

@ -192,6 +192,18 @@ class TestValidateSignature:
})
assert adapter._validate_signature(req, b"{}", "secret") is False
def test_non_ascii_svix_signature_rejected(self):
"""The Svix branch also runs its `v1,<sig>` comparison through the
hardened helper: a valid svix-id + fresh timestamp reaches the compare,
and a non-ASCII signature must reject rather than raise."""
adapter = _make_adapter()
req = _mock_request(headers={
"svix-id": "msg_2xabc",
"svix-timestamp": str(int(time.time())), # inside the replay window
"svix-signature": "v1,ské-not-a-valid-base64-sig",
})
assert adapter._validate_signature(req, b'{"x":1}', "shh-secret") is False
def test_non_ascii_secret_still_validates_a_matching_token(self):
"""A non-ASCII configured secret must still match its exact GitLab
token value byte for byte (bytes comparison keeps this working)."""