https://github.com/python/cpython/commit/197d33218f755af0758c83add3956e0bd7ef8657
commit: 197d33218f755af0758c83add3956e0bd7ef8657
branch: main
author: Bénédikt Tran <[email protected]>
committer: picnixz <[email protected]>
date: 2026-10-19T12:37:54-07:00
summary:
gh-155426: correctly reject non-bytes keys in `hmac.digest` (#155427)
This only affects keys of length smaller than the HMAC blocksize
since larger keys are hashed first.
files:
A Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
M Lib/hmac.py
M Lib/test/test_hmac.py
diff --git a/Lib/hmac.py b/Lib/hmac.py
index e0c040bcd5fe3d..61e0823e68be21 100644
--- a/Lib/hmac.py
+++ b/Lib/hmac.py
@@ -267,6 +267,9 @@ def digest(key, msg, digest):
def _compute_digest_fallback(key, msg, digest):
+ if not isinstance(key, (bytes, bytearray)):
+ raise TypeError(f"key: expected bytes or bytearray, "
+ f"but got {type(key).__name__!r}")
digest_cons = _get_digest_constructor(digest)
if _is_shake_constructor(digest_cons):
raise ValueError(f"unsupported hash algorithm {digest}")
diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
index c43188cc333e88..e44113edf3f422 100644
--- a/Lib/test/test_hmac.py
+++ b/Lib/test/test_hmac.py
@@ -1525,6 +1525,12 @@ def test_with_fallback(self):
finally:
cache.pop('foo')
+ @hashlib_helper.requires_hashdigest("md5")
+ def test_hmac_digest_reject_memoryview_for_key(self):
+ hmac = import_fresh_module("hmac", blocked=["_hashlib", "_hmac"])
+ with self.assertRaises(TypeError):
+ hmac.digest(memoryview(b"small"), b"world", "md5")
+
@hashlib_helper.requires_openssl_hashdigest("md5")
@bigmemtest(size=_4G + 5, memuse=2, dry_run=False)
def test_hmac_digest_overflow_error_openssl_only(self, size):
diff --git
a/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
new file mode 100644
index 00000000000000..f1839defbe5674
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
@@ -0,0 +1,4 @@
+Make sure that the pure Python fallback of :func:`hmac.digest` reject
+keys that are neither :class:`bytes` or :class:`bytearray`. Previously,
+an :exc:`AttributeError` was raised instead of :exc:`TypeError`.
+Patch by Bénédikt Tran.
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
