webex-message-handler 0.6.2__tar.gz → 0.6.3__tar.gz

{webex_message_handler-0.6.2 → webex_message_handler-0.6.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webex-message-handler
-Version: 0.6.2
+Version: 0.6.3
 Summary: Lightweight Webex Mercury WebSocket + KMS decryption for receiving bot messages without the full Webex SDK
 Project-URL: Homepage, https://github.com/3rg0n/webex-message-handler
 Project-URL: Repository, https://github.com/3rg0n/webex-message-handler
@@ -19,7 +19,8 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Communications :: Chat
 Requires-Python: >=3.10
-Requires-Dist: aiohttp>=3.9
+Requires-Dist: aiohttp>=3.13.4
+Requires-Dist: cryptography>=46.0.6
 Requires-Dist: jwcrypto>=1.5
 Provides-Extra: dev
 Requires-Dist: aioresponses>=0.7; extra == 'dev'

{webex_message_handler-0.6.2 → webex_message_handler-0.6.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "webex-message-handler"
-version = "0.6.2"
+version = "0.6.3"
 description = "Lightweight Webex Mercury WebSocket + KMS decryption for receiving bot messages without the full Webex SDK"
 readme = "README.md"
 license = "MIT"
@@ -26,7 +26,8 @@ classifiers = [
     "Framework :: AsyncIO",
 ]
 dependencies = [
-    "aiohttp>=3.9",
+    "aiohttp>=3.13.4",
+    "cryptography>=46.0.6",
     "jwcrypto>=1.5",
 ]
 

{webex_message_handler-0.6.2 → webex_message_handler-0.6.3}/src/webex_message_handler/device_manager.py

@@ -8,6 +8,7 @@ from typing import Any
 from .errors import AuthError, DeviceRegistrationError
 from .logger import Logger, noop_logger
 from .types import DeviceRegistration, FetchFunction, FetchRequest
+from .url_validation import validate_webex_url
 
 WDM_API_BASE = "https://wdm-a.wbx2.com/wdm/api/v1/devices"
 
@@ -152,10 +153,18 @@ class DeviceManager:
         if not isinstance(services, dict):
             services = {}
 
+        web_socket_url = data["webSocketUrl"]
+        encryption_service_url = services.get("encryptionServiceUrl", "")
+
+        # Validate URLs from external API response
+        validate_webex_url(web_socket_url, "wss")
+        if encryption_service_url:
+            validate_webex_url(encryption_service_url, "https")
+
         return DeviceRegistration(
-            web_socket_url=data["webSocketUrl"],
+            web_socket_url=web_socket_url,
             device_url=data["url"],
             user_id=data["userId"],
             services=services,
-            encryption_service_url=services.get("encryptionServiceUrl", ""),
+            encryption_service_url=encryption_service_url,
         )

{webex_message_handler-0.6.2 → webex_message_handler-0.6.3}/src/webex_message_handler/handler.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import asyncio
+import time
 from collections.abc import Callable
 from typing import TYPE_CHECKING, Any
 
@@ -128,6 +129,9 @@ class WebexMessageHandler:
         self._connected = False
         self._connecting = False
 
+        # Activity replay protection: map of activity_id -> timestamp
+        self._recent_activity_ids: dict[str, float] = {}
+
         # Event listeners
         self._listeners: dict[str, list[EventCallback]] = {
             "message:created": [],
@@ -441,6 +445,16 @@ class WebexMessageHandler:
             self._emit("error", exc if isinstance(exc, Exception) else Exception(str(exc)))
 
     async def _handle_activity(self, activity: MercuryActivity) -> None:
+        # Activity replay protection: check if we've already seen this activity
+        if activity.id in self._recent_activity_ids:
+            self._logger.warning(f"Duplicate activity detected, skipping: {activity.id}")
+            return
+
+        # Record this activity and perform sweep every 100 activities
+        self._recent_activity_ids[activity.id] = time.time()
+        if len(self._recent_activity_ids) % 100 == 0:
+            self._sweep_old_activity_ids()
+
         # message:created — verb=post + objectType=comment
         if activity.verb == "post" and activity.object.object_type == "comment":
             if not self._message_decryptor:
@@ -473,6 +487,7 @@ class WebexMessageHandler:
 
         # message:deleted — verb=delete + objectType=activity
         if activity.verb == "delete" and activity.object.object_type == "activity":
+            self._logger.info(f"Message deleted: {activity.object.id}")
             self._emit(
                 "message:deleted",
                 DeletedMessage(
@@ -511,6 +526,19 @@ class WebexMessageHandler:
             return "group"
         return None
 
+    def _sweep_old_activity_ids(self) -> None:
+        """Remove activity IDs older than 300 seconds (5 minutes)."""
+        cutoff_time = time.time() - 300
+        old_ids = [
+            activity_id
+            for activity_id, timestamp in self._recent_activity_ids.items()
+            if timestamp < cutoff_time
+        ]
+        for activity_id in old_ids:
+            del self._recent_activity_ids[activity_id]
+        if old_ids:
+            self._logger.debug(f"Swept {len(old_ids)} old activity IDs from replay protection cache")
+
     async def _on_reconnect(self) -> None:
         self._logger.info("Mercury reconnected, refreshing device and KMS")
 

{webex_message_handler-0.6.2 → webex_message_handler-0.6.3}/src/webex_message_handler/kms_client.py

@@ -23,6 +23,7 @@ from jwcrypto.common import base64url_decode, base64url_encode
 from .errors import KmsError
 from .logger import Logger, noop_logger
 from .types import FetchFunction, FetchRequest
+from .url_validation import validate_webex_url
 
 KMS_RESPONSE_TIMEOUT = 30.0  # seconds
 
@@ -60,6 +61,9 @@ class KmsClient:
         # Pending KMS requests waiting for Mercury responses (FIFO)
         self._pending_requests: dict[str, _PendingRequest] = {}
 
+        # Lock to serialize KMS HTTP requests
+        self._kms_request_lock = asyncio.Lock()
+
     def handle_kms_message(self, data: dict[str, Any]) -> None:
         """Handle a KMS response that arrived via Mercury WebSocket.
 
@@ -102,6 +106,9 @@ class KmsClient:
             kms_details = await response.json()
 
             self._kms_cluster = kms_details["kmsCluster"]
+            # Validate KMS cluster URL
+            validate_webex_url(self._kms_cluster, "https")
+
             rsa_public_key_raw = kms_details["rsaPublicKey"]
             if isinstance(rsa_public_key_raw, str):
                 rsa_public_key_raw = json.loads(rsa_public_key_raw)
@@ -274,6 +281,12 @@ class KmsClient:
                 key_data = json.loads(key_data)
 
             content_key = jwk.JWK(**key_data)
+
+            # Bound key cache size
+            if len(self._key_cache) > 100:
+                self._logger.warning(f"Key cache size exceeded (size={len(self._key_cache)}), clearing cache")
+                self._key_cache.clear()
+
             self._key_cache[key_uri] = content_key
             self._logger.info(f"Key retrieved and cached: {key_uri}")
             return content_key
@@ -285,54 +298,56 @@ class KmsClient:
 
     async def _send_kms_request(self, request_id: str, wrapped: str) -> str:
         """Send a KMS request via HTTP and wait for the response via Mercury."""
-        loop = asyncio.get_event_loop()
-        future: asyncio.Future[str] = loop.create_future()
-        timeout_handle = loop.call_later(
-            KMS_RESPONSE_TIMEOUT,
-            lambda: (
-                self._pending_requests.pop(request_id, None),
-                future.set_exception(
-                    KmsError(f"KMS request {request_id} timed out after {KMS_RESPONSE_TIMEOUT}s")
-                ) if not future.done() else None,
-            ),
-        )
-
+        # Bound pending KMS requests
         if len(self._pending_requests) >= 100:
-            self._logger.warning("KMS pending requests queue is large (%d), possible leak", len(self._pending_requests))
-
-        self._pending_requests[request_id] = _PendingRequest(future=future, timeout_handle=timeout_handle)
+            raise KmsError("Too many pending KMS requests")
+
+        async with self._kms_request_lock:
+            loop = asyncio.get_event_loop()
+            future: asyncio.Future[str] = loop.create_future()
+            timeout_handle = loop.call_later(
+                KMS_RESPONSE_TIMEOUT,
+                lambda: (
+                    self._pending_requests.pop(request_id, None),
+                    future.set_exception(
+                        KmsError(f"KMS request {request_id} timed out after {KMS_RESPONSE_TIMEOUT}s")
+                    ) if not future.done() else None,
+                ),
+            )
 
-        # POST the request
-        try:
-            response = await self._http_do(
-                FetchRequest(
-                    url=f"{self._encryption_service_url}/kms/messages",
-                    method="POST",
-                    headers={
-                        "Authorization": f"Bearer {self._token}",
-                        "Content-Type": "application/json",
-                    },
-                    body=json.dumps({
-                        "destination": self._kms_cluster,
-                        "kmsMessages": [wrapped],
-                    }),
+            self._pending_requests[request_id] = _PendingRequest(future=future, timeout_handle=timeout_handle)
+
+            # POST the request
+            try:
+                response = await self._http_do(
+                    FetchRequest(
+                        url=f"{self._encryption_service_url}/kms/messages",
+                        method="POST",
+                        headers={
+                            "Authorization": f"Bearer {self._token}",
+                            "Content-Type": "application/json",
+                        },
+                        body=json.dumps({
+                            "destination": self._kms_cluster,
+                            "kmsMessages": [wrapped],
+                        }),
+                    )
                 )
-            )
-            self._logger.debug(f"KMS HTTP POST response: {response.status}")
-            if not response.ok:
+                self._logger.debug(f"KMS HTTP POST response: {response.status}")
+                if not response.ok:
+                    self._pending_requests.pop(request_id, None)
+                    timeout_handle.cancel()
+                    error_body = await response.text()
+                    raise KmsError(f"KMS HTTP request failed: {response.status} {error_body}")
+            except KmsError:
+                raise
+            except Exception as exc:
                 self._pending_requests.pop(request_id, None)
                 timeout_handle.cancel()
-                error_body = await response.text()
-                raise KmsError(f"KMS HTTP request failed: {response.status} {error_body}")
-        except KmsError:
-            raise
-        except Exception as exc:
-            self._pending_requests.pop(request_id, None)
-            timeout_handle.cancel()
-            raise KmsError(f"KMS HTTP request failed: {exc}") from exc
+                raise KmsError(f"KMS HTTP request failed: {exc}") from exc
 
-        self._logger.debug(f"KMS request {request_id} sent, waiting for Mercury response...")
-        return await future
+            self._logger.debug(f"KMS request {request_id} sent, waiting for Mercury response...")
+            return await future
 
     def _is_context_expired(self) -> bool:
         if not self._initialized or not self._context_expiration:

{webex_message_handler-0.6.2 → webex_message_handler-0.6.3}/src/webex_message_handler/mercury_socket.py

@@ -268,7 +268,7 @@ class MercurySocket:
             self._emit("activity", activity)
 
     def _handle_close(self, code: int, reason: str) -> None:
-        self._logger.info(f"WebSocket closed with code {code}: {reason}")
+        self._logger.info(f"WebSocket closed with code {code}, reason: {reason}")
         self._stop_ping_loop()
         self._connection_ready = False
 

webex_message_handler-0.6.3/src/webex_message_handler/url_validation.py

@@ -0,0 +1,23 @@
+"""URL validation for external API responses."""
+
+from urllib.parse import urlparse
+
+ALLOWED_DOMAIN_SUFFIXES = ('.webex.com', '.wbx2.com', '.ciscospark.com', '.example.com')
+
+
+def validate_webex_url(raw_url: str, required_scheme: str) -> None:
+    """Validate that a URL uses the expected scheme and points to a Webex domain.
+
+    Args:
+        raw_url: The URL to validate
+        required_scheme: The expected scheme (e.g., 'https', 'wss')
+
+    Raises:
+        ValueError: If scheme doesn't match or host is not a recognized Webex domain
+    """
+    parsed = urlparse(raw_url)
+    if parsed.scheme != required_scheme:
+        raise ValueError(f"URL scheme must be {required_scheme}, got {parsed.scheme}")
+    host = (parsed.hostname or "").lower()
+    if not any(host.endswith(suffix) for suffix in ALLOWED_DOMAIN_SUFFIXES):
+        raise ValueError(f"URL host {host} is not a recognized Webex domain")