From 4ccb232af905736b65db94644acef0532f2dcf04 Mon Sep 17 00:00:00 2001 From: Drexuxux Date: Thu, 16 Jul 2026 15:14:48 +0300 Subject: [PATCH] test(webhook): cover the Svix v1 branch in the non-ASCII signature regression The fix routes the Svix v1 comparison through _hmac_str_equal too, but the existing non-ASCII tests only exercised the GitHub/GitLab/generic V1/V2 branches. Add a Svix case (valid svix-id + fresh svix-timestamp so it reaches the v1, compare) with a non-ASCII signature, which raised TypeError before the fix and now rejects cleanly. --- tests/gateway/test_webhook_adapter.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tests/gateway/test_webhook_adapter.py b/tests/gateway/test_webhook_adapter.py index eb53b95ad4bc..95ca6079ffbe 100644 --- a/tests/gateway/test_webhook_adapter.py +++ b/tests/gateway/test_webhook_adapter.py @@ -192,6 +192,18 @@ class TestValidateSignature: }) assert adapter._validate_signature(req, b"{}", "secret") is False + def test_non_ascii_svix_signature_rejected(self): + """The Svix branch also runs its `v1,` comparison through the + hardened helper: a valid svix-id + fresh timestamp reaches the compare, + and a non-ASCII signature must reject rather than raise.""" + adapter = _make_adapter() + req = _mock_request(headers={ + "svix-id": "msg_2xabc", + "svix-timestamp": str(int(time.time())), # inside the replay window + "svix-signature": "v1,ské-not-a-valid-base64-sig", + }) + assert adapter._validate_signature(req, b'{"x":1}', "shh-secret") is False + def test_non_ascii_secret_still_validates_a_matching_token(self): """A non-ASCII configured secret must still match its exact GitLab token value byte for byte (bytes comparison keeps this working)."""