Skip to content

🐛 fix parameter verifications in HMAC method #439

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ianardee merged 1 commit into from
Sep 7, 2026
Merged

🐛 fix parameter verifications in HMAC method #439

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions src/Mindee/Parsing/BaseLocalResponse.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ public abstract class BaseLocalResponse
/// <summary>
/// Load from a string.
/// </summary>
/// <param name="input">Will be decoded as UTF-8.</param>
/// <param name="input">Assumes UTF-8 encoding.</param>
Comment thread
ianardee marked this conversation as resolved.
protected BaseLocalResponse(string input)
{
if (input == null)
Expand All @@ -31,7 +31,7 @@ protected BaseLocalResponse(string input)
/// <summary>
/// Load from a byte buffer.
/// </summary>
/// <param name="input">Assumes UTF-8 encoding.</param>
/// <param name="input">Will be decoded as UTF-8.</param>
protected BaseLocalResponse(byte[] input)
{
if (input == null)
Expand All @@ -48,9 +48,7 @@ protected BaseLocalResponse(byte[] input)
/// Load from a Stream.
/// This method will not close the provided stream.
/// </summary>
/// <param name="input">
/// Assumes UTF-8 encoding.
/// </param>
/// <param name="input">Will be decoded as UTF-8.</param>
protected BaseLocalResponse(Stream input)
{
if (input == null)
Expand Down Expand Up @@ -127,15 +125,17 @@ public string GetHmacSignature(string secretKey)
/// <param name="signature">The signature from the "X-Signature" HTTP header.</param>
public bool IsValidHmacSignature(string secretKey, string signature)
{
if (string.IsNullOrEmpty(signature))
{
if (string.IsNullOrWhiteSpace(secretKey) || string.IsNullOrWhiteSpace(signature))
return false;
}

string expectedSignature = GetHmacSignature(secretKey);
if (string.IsNullOrWhiteSpace(expectedSignature))
return false;

byte[] expectedBytes = Encoding.UTF8.GetBytes(expectedSignature);
byte[] actualBytes = Encoding.UTF8.GetBytes(signature.ToLower());
if (expectedBytes.Length != actualBytes.Length)
return false;

return FixedTimeEquals(expectedBytes, actualBytes);
}
Expand Down
4 changes: 3 additions & 1 deletion tests/Mindee.UnitTests/V2/Parsing/ErrorResponseTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,11 @@

namespace Mindee.UnitTests.V2.Parsing
{
[Trait("Category", "V2")]
[Trait("Category", "Error Response")]
public class ErrorResponseTest
{
[Fact]
[Fact(DisplayName = "should load and pretty print an error response")]
public void RstOutput_mustBeValid()
{
var localResponse = new LocalResponse(
Expand Down
22 changes: 11 additions & 11 deletions tests/Mindee.UnitTests/V2/Parsing/JobTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,17 @@
namespace Mindee.UnitTests.V2.Parsing
{
[Trait("Category", "V2")]
[Trait("Category", "Job")]
[Trait("Category", "Job Response")]
public class JobTest
{
[Fact]
private static JobResponse GetJob(string path)
{
var localResponse = new LocalResponse(
File.ReadAllText(Constants.V2ResourcePath + path));
return localResponse.DeserializeJobResponse();
}

[Fact(DisplayName = "should load when status is Processing")]
public void OkProcessing_MustHaveValidProperties()
{
var response = GetJob("job/ok_processing.json");
Expand All @@ -21,7 +28,7 @@ public void OkProcessing_MustHaveValidProperties()
Assert.Equal("Processing", response.Job.Status);
}

[Fact]
[Fact(DisplayName = "should load when status is Processed")]
public void OkProcessed_WebhooksOk_MustHaveValidProperties()
{
var response = GetJob("job/ok_processed_webhooks_ok.json");
Expand All @@ -45,7 +52,7 @@ public void OkProcessed_WebhooksOk_MustHaveValidProperties()
Assert.Null(webhook.Error);
}

[Fact]
[Fact(DisplayName = "should load with 422 error")]
public void Error_422_MustHaveValidProperties()
{
var response = GetJob("job/fail_422.json");
Expand All @@ -61,12 +68,5 @@ public void Error_422_MustHaveValidProperties()
Assert.Contains("must be a valid", error.Errors.First().Detail);
Assert.Equal("Failed", response.Job.Status);
}

private static JobResponse GetJob(string path)
{
var localResponse = new LocalResponse(
File.ReadAllText(Constants.V2ResourcePath + path));
return localResponse.DeserializeJobResponse();
}
}
}
25 changes: 17 additions & 8 deletions tests/Mindee.UnitTests/V2/Parsing/LocalResponseTest.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,20 @@ public class LocalResponseTest
private const string DummySecretKey = "ogNjY44MhvKPGTtVsI8zG82JqWQa68woYQH";
private const string FilePath = "extraction/standard_field_types.json";

/// <summary>
/// Asserts that a local response is valid.
/// </summary>
private static void AssertLocalResponse(LocalResponse localResponse, string fileContent)
{
Assert.False(localResponse.IsValidHmacSignature(DummySecretKey, "invalid signature"));
Assert.Equal(Signature, localResponse.GetHmacSignature(DummySecretKey));

Assert.False(localResponse.IsValidHmacSignature(DummySecretKey, "invalid signature"));
Assert.False(localResponse.IsValidHmacSignature(DummySecretKey, null));
Assert.False(localResponse.IsValidHmacSignature(null, Signature));
Assert.False(localResponse.IsValidHmacSignature(null, null));
Assert.False(localResponse.IsValidHmacSignature(DummySecretKey, ""));
Assert.True(localResponse.IsValidHmacSignature(DummySecretKey, Signature));
Assert.True(localResponse.IsValidHmacSignature(DummySecretKey, Signature.ToUpper()));
Comment thread
ianardee marked this conversation as resolved.

var response = localResponse.DeserializeResponse<ExtractionResponse>();

Expand All @@ -35,7 +44,7 @@ private static void AssertLocalResponse(LocalResponse localResponse, string file
}

[Fact(DisplayName = "should load a response from a JSON string")]
public void JsonString_mustLoadValidLocalResponse()
public void ValidString_mustLoadValidLocalResponse()
{
string filePath = Path.Combine(Constants.V2ProductPath, FilePath);
string fileContent = File.ReadAllText(filePath);
Expand All @@ -45,7 +54,7 @@ public void JsonString_mustLoadValidLocalResponse()
}

[Fact(DisplayName = "should load a response from a buffer")]
public void Buffer_mustLoadValidLocalResponse()
public void ValidBuffer_mustLoadValidLocalResponse()
{
string filePath = Path.Combine(Constants.V2ProductPath, FilePath);
var localResponse = new LocalResponse(File.ReadAllBytes(filePath));
Expand All @@ -54,7 +63,7 @@ public void Buffer_mustLoadValidLocalResponse()
}

[Fact(DisplayName = "should load a response from a JSON file")]
public void JsonFile_mustLoadValidLocalResponse()
public void ValidFile_mustLoadValidLocalResponse()
{
string filePath = Path.Combine(Constants.V2ProductPath, FilePath);
var localResponse = new LocalResponse(new FileInfo(filePath));
Expand All @@ -63,7 +72,7 @@ public void JsonFile_mustLoadValidLocalResponse()
}

[Fact(DisplayName = "should load a response from a stream")]
public void Stream_mustLoadValidLocalResponse()
public void ValidStream_mustLoadValidLocalResponse()
{
string filePath = Path.Combine(Constants.V2ProductPath, FilePath);
using (var stream = File.OpenRead(filePath))
Expand All @@ -78,7 +87,7 @@ public void Stream_mustLoadValidLocalResponse()
}

[Fact(DisplayName = "should raise an exception when given an invalid JSON string")]
public void InvalidJsonString_mustRaiseException()
public void InvalidString_mustRaiseException()
{
var localResponse = new LocalResponse("{invalid json");

Expand All @@ -88,7 +97,7 @@ public void InvalidJsonString_mustRaiseException()
}

[Fact(DisplayName = "should raise an exception when given an empty value")]
public void EmptyString_mustRaiseException()
public void EmptyValue_mustRaiseException()
{
Assert.Throws<ArgumentException>(
() => new LocalResponse("")
Expand All @@ -102,7 +111,7 @@ public void EmptyString_mustRaiseException()
}

[Fact(DisplayName = "should raise an exception when given a null value")]
public void Null_mustRaiseException()
public void NullValue_mustRaiseException()
{
Assert.Throws<ArgumentNullException>(
() => new LocalResponse((string?)null)
Expand Down
Loading