Skip to content
This repository was archived by the owner on Nov 19, 2018. It is now read-only.

Make sure hmac isn't given a unicode string #61

Merged
merged 1 commit into from
Jan 12, 2017

Conversation

kyrrigle
Copy link
Contributor

So I ran into a problem with this today where the headers were unicode which isn't supported for python2 hmac. Converting to a bytearray seems like a reasonable guard against this and might help others.

@CLAassistant
Copy link

CLAassistant commented Jan 11, 2017

CLA assistant check
All committers have signed the CLA.

@rnicholus
Copy link
Member

Were you able to verify this locally such that it fixes your issue and didn't cause any other obvious issues? I'm not using Python on any projects and am unable to verify at this time?

@kyrrigle
Copy link
Contributor Author

kyrrigle commented Jan 12, 2017

Yes...

Starting the code thusly-

AWS_CLIENT_SECRET_KEY=foobar python app.py

and sending in a request-

curl --request POST \
  --url http://localhost:5000/s3/sign \
  --header 'content-type: application/json' \
  --data '{"headers":"😎"}'

The un-patched code throws a 500 error while the patch-1 code returns-

{ "signature": "lifmnNdZDK4yrGeX875UyCdFEkM=" }

As a sanity check if I instead send in an innocuous header text both versions come up with the same signature-

{ "headers": "some text to sign" }

{ "signature": "Tb2/i33y+AoKgKr+8BakjLWuMjE=" }

@rnicholus
Copy link
Member

Cool. Thanks for finding & fixing this!

@rnicholus rnicholus merged commit c2192dd into FineUploader:master Jan 12, 2017
@kyrrigle kyrrigle deleted the patch-1 branch January 12, 2017 15:40
@kyrrigle
Copy link
Contributor Author

No problem. Thanks for providing the examples!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants