From d7df61b937d45d3bab9cc8193b679effb1c3aee2 Mon Sep 17 00:00:00 2001 From: vvzvlad Date: Fri, 7 Feb 2025 01:57:24 +0300 Subject: [PATCH] Tighten media URL signature verification logic --- url_signer.py | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/url_signer.py b/url_signer.py index 75ad4a8..a27df0c 100644 --- a/url_signer.py +++ b/url_signer.py @@ -44,12 +44,12 @@ def generate_media_digest(url: str) -> str: return signature.hexdigest()[:8] def verify_media_digest(url: str, digest: str | None) -> bool: - """Verify media URL signature""" - if not Config["media_url_signing_key"]: - return True # If no key configured, accept all requests + """ + Verify HMAC digest for media URL + Returns True if digest is valid + """ + if not digest: + return False - if digest is None: - return True # Accept requests without digest if signing is not enforced - - expected_digest = generate_media_digest(url) - return hmac.compare_digest(digest, expected_digest) + expected = generate_media_digest(url) + return hmac.compare_digest(expected, digest)