From 48dfe157270fb0a1d0a2360cfa580d59f9a75181 Mon Sep 17 00:00:00 2001 From: Sophie <49928680+sophiecarreras@users.noreply.github.com> Date: Mon, 2 Nov 2026 09:17:39 -0300 Subject: [PATCH] sdkharness: conformance check refuses a missing signature header when a secret is given B2EventNotification.parse(...) skips verification when the X-Bz-Event-Notification-Signature header is null even though a signing secret was passed. The check already refuses an empty header; add the null-header case for both overloads, so the harness reports it (known issue tracking in backblaze-labs/demand-side-ai). Co-Authored-By: Claude Sonnet 5.5 --- .sdkharness/tests/conformance/BucketInboundWebhook.java | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.sdkharness/tests/conformance/BucketInboundWebhook.java b/.sdkharness/tests/conformance/BucketInboundWebhook.java index c51064f40..326826f0f 100644 --- a/.sdkharness/tests/conformance/BucketInboundWebhook.java +++ b/.sdkharness/tests/conformance/BucketInboundWebhook.java @@ -22,7 +22,7 @@ * server round trip: a payload shaped like the documented example is signed in this check with its own HMAC code (not * the SDK's), then given to {@code B2EventNotification.parse}. Asserted: with the right secret the payload is accepted * and every documented event field is read back; with another secret, with the payload changed after signing, and - * with a signature that is not v1 hex, it is refused with {@code B2SignatureVerificationException}; a test event (no + * with a signature that is not v1 hex, with an empty signature, and with no signature header at all while a secret is given, it is refused with {@code B2SignatureVerificationException}; a test event (no * object fields) parses. */ public class BucketInboundWebhook { @@ -71,6 +71,10 @@ public static void main(String[] args) { refused("a signature without the v1= prefix", () -> B2EventNotification.parse(body, sign(body, SECRET).substring(3), SECRET)); refused("an empty signature", () -> B2EventNotification.parse(body, "", SECRET)); + Support.step("refuse a missing signature header when a secret is given"); + refused("a missing signature header with a secret", () -> B2EventNotification.parse(body, null, SECRET)); + refused("a missing signature header with a secret (string overload)", () -> B2EventNotification.parse(PAYLOAD, null, SECRET)); + Support.step("a test event"); final byte[] test = TEST_PAYLOAD.getBytes(StandardCharsets.UTF_8); final B2EventNotificationEvent testEvent = B2EventNotification.parse(test, sign(test, SECRET), SECRET).getEvents().get(0);