From 370715e647f2f3a96343cf71e60dc27424f9c775 Mon Sep 17 00:00:00 2001 From: Helmut Grohne Date: Wed, 1 Apr 2020 21:00:48 +0200 Subject: don't call secrets.compare_digest with a None value The __call__ method may return None to indicate failure. Using compare_digest with a None value results in a TypeError. Fixes: ab06a888e216 ("use secrets.compare_digest when available") --- wsgitools/digest.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/wsgitools/digest.py b/wsgitools/digest.py index 846257a..ffdf063 100644 --- a/wsgitools/digest.py +++ b/wsgitools/digest.py @@ -187,7 +187,10 @@ class AbstractTokenGenerator(object): assert isinstance(username, str) assert isinstance(password, str) token = "%s:%s:%s" % (username, self.realm, password) - return compare_digest(md5hex(token), self(username)) + expected = self(username) + if expected is None: + return False + return compare_digest(md5hex(token), expected) __all__.append("AuthTokenGenerator") class AuthTokenGenerator(AbstractTokenGenerator): -- cgit v1.2.3