From 95c8a8f984855ea68e979666601d29b70a1f2553 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 15:07:16 -1000 Subject: Hold signatures to the length SHA-256 gives The fake HMAC returned 16 bytes, so the checks signed with signatures half the real length, and a signature cut short passed. tohex's output was never pinned either, so dropping its zero padding stayed consistent with itself and passed. --- tests/extensions/harness.lua | 5 ++++- tests/extensions/test-auth.lua | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-) (limited to 'tests') diff --git a/tests/extensions/harness.lua b/tests/extensions/harness.lua index 1a669ff..ead3c97 100644 --- a/tests/extensions/harness.lua +++ b/tests/extensions/harness.lua @@ -311,11 +311,14 @@ function harness.stub_auth_modules() return table.concat(out) end, }) + -- An HMAC-SHA256 is 32 bytes, twice what one fake digest gives, so two + -- of different input are joined to make signatures the real length. preload("openssl.hmac", { new = function(key, algorithm) return { final = function(self, payload) - return fake_digest_bytes(key .. "\1" .. algorithm .. "\1" .. payload) + local text = key .. "\1" .. algorithm .. "\1" .. payload + return fake_digest_bytes(text) .. fake_digest_bytes("\2" .. text) end, } end, diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index d91287a..a7e1b70 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -292,6 +292,9 @@ local now = os.time() local cookie = secure_value("username", "alice", now + 3600) h.equals("a signed value verifies and comes back", validate_value("username", cookie), "alice") +local signature = cookie:match("|(%x+)$") +h.equals("its signature is a whole SHA-256 in hex", signature and #signature, 64) +h.equals("each byte becomes two hex digits", tohex("\0\15\255"), "000fff") cookie = secure_value("username", "a|b", now + 3600) h.equals("a value holding the separator survives the round trip", validate_value("username", cookie), "a|b") -- cgit 2.12.1