thumbor / libthumbor / 39154255360

100%

push

github

Compare signatures in constant time and mark MD5 as non-security

BaseUrlSigner.validate compared the expected and the received signature
with ==, which short-circuits on the first differing byte. For a 20-byte
HMAC that leak is hard to exploit over a network, but hmac.compare_digest
exists for exactly this comparison and costs one line. Both sides are
normalized to bytes first so callers that pass the signature as str, which
== silently treated as a mismatch, keep working. A signature that is
neither text nor bytes, such as None, still returns False instead of
reaching compare_digest, which raises TypeError for it. url_for hashes
image_url with MD5 only to build the legacy URL path, so the call now
passes usedforsecurity=False; on interpreters built with FIPS enforcement
md5() raises without that flag, and a test pins it because no other test
would notice it going missing.

Behavior for every existing caller is unchanged except that a str signature
is now compared by value instead of always failing. This overlaps with the
six removal on the same two files and will need a trivial rebase on
whichever lands second.

9 of 9 new or added lines in 2 files covered. (100.0%)

268 of 268 relevant lines covered (100.0%)

5.0 hits per line