fix(utils): use hmac.compare_digest for secure WebApp signature valid…#1710
Merged
JrooTJunior merged 1 commit intoaiogram:dev-3.xfrom Jul 19, 2025
Merged
fix(utils): use hmac.compare_digest for secure WebApp signature valid…#1710JrooTJunior merged 1 commit intoaiogram:dev-3.xfrom
JrooTJunior merged 1 commit intoaiogram:dev-3.xfrom
Conversation
✔️ Changelog found.Thank you for adding a description of the changes |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## dev-3.x #1710 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 578 578
Lines 13531 13531
=========================================
Hits 13531 13531
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR fixes a security vulnerability in WebApp signature validation by replacing an insecure string comparison with a constant-time comparison function. The change prevents potential timing attacks during cryptographic verification while maintaining the same functionality.
Key changes:
- Replace
==operator withhmac.compare_digest()for HMAC signature comparison - Add changelog entry documenting the security improvement
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| aiogram/utils/web_app.py | Updates signature validation to use secure constant-time comparison |
| CHANGES/1709.bugfix.rst | Documents the security fix in the changelog |
JrooTJunior
approved these changes
Jul 19, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fix(utils): use hmac.compare_digest for secure WebApp signature validation
The WebApp signature validation in
utils.web_appcurrently compares the calculated HMAC with the provided hash using==. While this works correctly for cryptographic verification, it may theoretically leak timing information.This change replaces the comparison with
hmac.compare_digest, which is designed to perform constant-time comparisons and is recommended for all cryptographic checks. Although practical timing attacks are unlikely in this context, this change improves overall security best practices.Description
This pull request addresses a potential vulnerability in the WebApp signature validation mechanism. The current implementation uses the
==operator to compare the calculated HMAC signature with the provided hash. This could be susceptible to timing attacks, as standard string comparison does not execute in constant time.This change replaces the insecure comparison with
hmac.compare_digest, which is the recommended practice for cryptographic operations in Python and mitigates such attacks.Fixes #1711
Type of change
How Has This Been Tested?
I have confirmed that my changes are effective and do not break existing functionality by adding unit tests that cover the following scenarios:
hmac.compare_digest.False.Test Configuration:
Checklist:
Special thanks to @desspperate for helping to find and resolve this issue.