Skip to content

NH-154954 Harden x-trace-options sig check #922

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tammy-baylis-swi wants to merge 3 commits into
base: main
Choose a base branch
from
Open

NH-154954 Harden x-trace-options sig check #922

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
569a16c
hmac the sig check
tammy-baylis-swi Nov 6, 2026
fb65945
Implement test for malformed signature rejection
tammy-baylis-swi Nov 6, 2026
94fbfcb
Lint
tammy-baylis-swi Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion solarwinds_apm/oboe/trace_options.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -382,6 +382,10 @@ def validate_signature(header, signature, key, timestamp):
"Failed to encode key or header for signature validation: %s", exc
)
return Auth.BAD_SIGNATURE
if signature == digest:
try:
signature_matches = hmac.compare_digest(signature, digest)
except (TypeError, ValueError):
return Auth.BAD_SIGNATURE
if signature_matches:
return Auth.OK
return Auth.BAD_SIGNATURE
23 changes: 23 additions & 0 deletions tests/unit/test_oboe/test_trace_options.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -351,3 +351,26 @@ def test_stringify_trace_options_response():
def test_validate_signature(header, signature, key, timestamp, expected):
result = validate_signature(header, signature, key, timestamp)
assert result == expected


def test_validate_signature_uses_constant_time_comparison(mocker):
compare_digest = mocker.patch(
"solarwinds_apm.oboe.trace_options.hmac.compare_digest",
return_value=True,
)

result = validate_signature("header", "signature", "key", int(time.time()))

compare_digest.assert_called_once()
assert result == Auth.OK
Comment thread
Copilot marked this conversation as resolved.
Resolved


@pytest.mark.parametrize(
"signature", ["", "not-a-digest", "é", None, b"signature", 123]
)
def test_validate_signature_rejects_malformed_signatures(
signature: object,
) -> None:
"""Reject malformed signatures without propagating comparison errors."""
result = validate_signature("header", signature, "key", int(time.time()))
assert result == Auth.BAD_SIGNATURE
Loading