[security] SDK hardening: distinct unverified status, payload binding#55
Merged
Conversation
…binding SEC-SDK-002: Return UNVERIFIED_FORMAT_OK (score 50, success=false) instead of success when no public key provided SEC-SDK-003: After JWS verification, compare decoded payload to caller-supplied payload via canonical JSON
|
✅ Documentation validation passed!
|
|
✅ All checks passed! Ready for review. |
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
There was a problem hiding this comment.
Pull request overview
This PR hardens the legacy Python SignatureValidator by (1) distinguishing “format-only / unverified” signatures from cryptographically verified signatures and (2) binding a verified JWS to the caller-supplied payload to prevent payload substitution.
Changes:
- Change the no-public-key path to emit
UNVERIFIED_FORMAT_OKand returnsuccess=Falsewith a reduced score (format-only validation no longer counts as success). - After successful JWS verification, compare decoded payload vs the supplied payload and emit
PAYLOAD_MISMATCHon mismatch.
Comment on lines
+175
to
179
| code="UNVERIFIED_FORMAT_OK", | ||
| message="Signature format valid but cryptographic verification not performed (no public key provided)", | ||
| path="signatures", | ||
| ) | ||
| ) |
Comment on lines
+175
to
179
| code="UNVERIFIED_FORMAT_OK", | ||
| message="Signature format valid but cryptographic verification not performed (no public key provided)", | ||
| path="signatures", | ||
| ) | ||
| ) |
Comment on lines
+113
to
+117
| if caller_json != decoded_json: | ||
| issues.append( | ||
| ValidationIssue( | ||
| severity=ValidationSeverity.ERROR, | ||
| code="PAYLOAD_MISMATCH", |
Comment on lines
+176
to
+180
| message="Signature format valid but cryptographic verification not performed (no public key provided)", | ||
| path="signatures", | ||
| ) | ||
| ) | ||
| score = 70 # Format is OK but not verified | ||
| score = 50 # Format-only: below success threshold |
Comment on lines
+109
to
+113
| # Bind: compare decoded payload against caller-supplied payload | ||
| # Use canonical JSON comparison to avoid ordering issues | ||
| caller_json = json.dumps(payload, sort_keys=True, separators=(',', ':')) | ||
| decoded_json = json.dumps(decoded, sort_keys=True, separators=(',', ':')) | ||
| if caller_json != decoded_json: |
…n import - Replace JSON canonical comparison with direct dict equality (simpler, correct) - Remove unused json import
|
✅ Documentation validation passed!
|
|
✅ All checks passed! Ready for review. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Audit Remediation — SDK Python Hardening
Changes
validate_signaturenow returnssuccess=Falsewith codeUNVERIFIED_FORMAT_OK(score 50) instead ofsuccess=True(score 70). Callers that pattern-matched on success for format-only validation should check for theUNVERIFIED_FORMAT_OKissue code.PAYLOAD_MISMATCHerror.Breaking Changes
validate_signature()without a public key previously returnedsuccess=True. Now returnssuccess=Falsewith aWARNINGissue codeUNVERIFIED_FORMAT_OK.