paddle-python-sdk 1.16.0__tar.gz → 1.16.1__tar.gz

{paddle_python_sdk-1.16.0/paddle_python_sdk.egg-info → paddle_python_sdk-1.16.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: paddle-python-sdk
-Version: 1.16.0
+Version: 1.16.1
 Summary: Paddle's Python SDK for Paddle Billing
 Home-page: https://developer.paddle.com/api-reference/overview
 Author: Paddle and contributors

{paddle_python_sdk-1.16.0 → paddle_python_sdk-1.16.1}/paddle_billing/Client.py

@@ -211,7 +211,7 @@ class Client:
                 "Authorization": f"Bearer {self.__api_key}",
                 "Content-Type": "application/json",
                 "Paddle-Version": str(self.use_api_version),
-                "User-Agent": "PaddleSDK/python 1.16.0",
+                "User-Agent": "PaddleSDK/python 1.16.1",
             }
         )
 

{paddle_python_sdk-1.16.0 → paddle_python_sdk-1.16.1}/paddle_billing/Notifications/PaddleSignature.py

@@ -56,9 +56,8 @@ class PaddleSignature:
         return hmac_new(secret_key.encode("utf-8"), data, sha256)
 
     def __do_comparison(self, generated_signature: str, signature: str) -> bool:
-        self.log.debug(
-            f"Comparing received Paddle signature '{signature}' to our calculated signature: '{generated_signature}'"
-        )
+        # Never log either signature: the calculated one is a valid signature for an attacker-chosen body
+        self.log.debug("Comparing received Paddle signature to our calculated signature")
 
         return compare_digest(generated_signature, signature)
 

{paddle_python_sdk-1.16.0 → paddle_python_sdk-1.16.1}/paddle_billing/Notifications/Verifier.py

@@ -37,9 +37,14 @@ class Verifier:
             return False
 
         timestamp, signature = PaddleSignature.parse(signature_header)
-        if verify_time_drift and self.maximum_variance > 0 and time() > int(timestamp + self.maximum_variance):
-            self.log.critical("Too much time has elapsed between the request and this process")
-            return False
+        if verify_time_drift and self.maximum_variance > 0:
+            now = time()
+            if now > int(timestamp + self.maximum_variance):
+                self.log.critical("Too much time has elapsed between the request and this process")
+                return False
+            if int(timestamp - self.maximum_variance) > now:
+                self.log.critical("The request timestamp is too far in the future")
+                return False
 
         raw_body = None
         if hasattr(request, "body"):

{paddle_python_sdk-1.16.0 → paddle_python_sdk-1.16.1/paddle_python_sdk.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: paddle-python-sdk
-Version: 1.16.0
+Version: 1.16.1
 Summary: Paddle's Python SDK for Paddle Billing
 Home-page: https://developer.paddle.com/api-reference/overview
 Author: Paddle and contributors

{paddle_python_sdk-1.16.0 → paddle_python_sdk-1.16.1}/setup.py

@@ -1,7 +1,7 @@
 from setuptools import setup, find_packages
 
 setup(
-    version="1.16.0",
+    version="1.16.1",
     author="Paddle and contributors",
     author_email="team-dx@paddle.com",
     description="Paddle's Python SDK for Paddle Billing",

{paddle_python_sdk-1.16.0 → paddle_python_sdk-1.16.1}/tests/Unit/Notification/test_Verifier.py

@@ -1,3 +1,6 @@
+import logging
+from time import time
+
 from pytest import mark
 
 from paddle_billing.Notifications import PaddleSignature, Verifier, Secret
@@ -57,3 +60,35 @@ class TestVerifier:
 
         integrity_check = Verifier().verify(request, Secret(secret))
         assert integrity_check is True
+
+    @staticmethod
+    def _signed_request(secret: str, body: str, timestamp: int) -> FakeRequest:
+        signature = PaddleSignature.calculate_hmac(secret, f"{timestamp}:{body}".encode("utf-8")).hexdigest()
+
+        return FakeRequest({PaddleSignature().HEADER: f"ts={timestamp};h1={signature}"}, body)
+
+    @mark.parametrize(
+        "offset, expected",
+        [(0, True), (-60, False), (60, False), (315360000, False)],
+        ids=["Current timestamp", "Old timestamp", "Future timestamp", "Far future timestamp"],
+    )
+    def test_verify_rejects_timestamps_outside_maximum_variance(self, monkeypatch, offset, expected):
+        monkeypatch.delenv("TEST_MODE", raising=False)
+        secret = "pdl_ntfset_01hs0t3tw21j988db1pam5xg8m_GrOWLNef+vmtjJYq4mSnHNzvc8uWoJ1I"
+        request = self._signed_request(secret, '{"event_type":"transaction.completed"}', int(time()) + offset)
+
+        assert Verifier().verify(request, Secret(secret)) is expected
+
+    def test_verify_does_not_log_signatures(self, monkeypatch, caplog):
+        monkeypatch.setenv("TEST_MODE", "1")
+        caplog.set_level(logging.DEBUG, logger="paddle_billing")
+        secret = "pdl_ntfset_01hs0t3tw21j988db1pam5xg8m_GrOWLNef+vmtjJYq4mSnHNzvc8uWoJ1I"
+        body = '{"event_type":"transaction.completed"}'
+        timestamp = int(time())
+        received_signature = "f" * 64
+        calculated_signature = PaddleSignature.calculate_hmac(secret, f"{timestamp}:{body}".encode("utf-8")).hexdigest()
+        request = FakeRequest({PaddleSignature().HEADER: f"ts={timestamp};h1={received_signature}"}, body)
+
+        assert Verifier().verify(request, Secret(secret)) is False
+        assert calculated_signature not in caplog.text
+        assert received_signature not in caplog.text