From 65f56a3083a27861103b728310525eacfb15b574 Mon Sep 17 00:00:00 2001 From: Vale <4655956+hrco@users.noreply.github.com> Date: Wed, 1 Jul 2026 20:27:34 +0200 Subject: [PATCH] fix: encode order_id to bytes before hmac.compare_digest hmac.compare_digest raises TypeError on non-ASCII str input, so a crafted non-ASCII order_id on /keys/mine crashed with a 500 instead of the intended 404. Flagged by CodeRabbit on PR #26. --- tests/test_key_provisioning.py | 6 ++++++ xbridge_mcp/http_server.py | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/tests/test_key_provisioning.py b/tests/test_key_provisioning.py index 74de2c5..3fcbaf1 100644 --- a/tests/test_key_provisioning.py +++ b/tests/test_key_provisioning.py @@ -128,3 +128,9 @@ def test_blank_order_id_returns_400(self, hs): _post_subscription(client, "xBridge Founder", "buyer@example.com") resp = client.post("/keys/mine", json={"email": "buyer@example.com", "order_id": ""}) assert resp.status_code == 400 + + def test_non_ascii_order_id_returns_404_not_500(self, hs): + client = TestClient(hs.app) + _post_subscription(client, "xBridge Founder", "buyer@example.com") + resp = client.post("/keys/mine", json={"email": "buyer@example.com", "order_id": "ord-é123"}) + assert resp.status_code == 404 diff --git a/xbridge_mcp/http_server.py b/xbridge_mcp/http_server.py index 9cd71ca..c8953bd 100644 --- a/xbridge_mcp/http_server.py +++ b/xbridge_mcp/http_server.py @@ -254,7 +254,9 @@ async def keys_mine(request: Request): return not_found stored_order_id = str(entry.get("order_id") or "") - if not stored_order_id or not hmac.compare_digest(submitted_order_id, stored_order_id): + if not stored_order_id or not hmac.compare_digest( + submitted_order_id.encode("utf-8"), stored_order_id.encode("utf-8") + ): return not_found return JSONResponse({"key": entry["key"], "tier": entry["tier"], "email": email})