From 95c8a8f984855ea68e979666601d29b70a1f2553 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 15:07:16 -1000 Subject: Hold signatures to the length SHA-256 gives The fake HMAC returned 16 bytes, so the checks signed with signatures half the real length, and a signature cut short passed. tohex's output was never pinned either, so dropping its zero padding stayed consistent with itself and passed. --- tests/extensions/harness.lua | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'tests/extensions/harness.lua') diff --git a/tests/extensions/harness.lua b/tests/extensions/harness.lua index 1a669ff..ead3c97 100644 --- a/tests/extensions/harness.lua +++ b/tests/extensions/harness.lua @@ -311,11 +311,14 @@ function harness.stub_auth_modules() return table.concat(out) end, }) + -- An HMAC-SHA256 is 32 bytes, twice what one fake digest gives, so two + -- of different input are joined to make signatures the real length. preload("openssl.hmac", { new = function(key, algorithm) return { final = function(self, payload) - return fake_digest_bytes(key .. "\1" .. algorithm .. "\1" .. payload) + local text = key .. "\1" .. algorithm .. "\1" .. payload + return fake_digest_bytes(text) .. fake_digest_bytes("\2" .. text) end, } end, -- cgit 2.12.1