wire: differentiate between invalid cbor and malformed cbor errors
What the developer wrote
Authored by Jon Griffiths
wire: differentiate between invalid cbor and malformed cbor errors
What changed, and why it matters
This commit only changes an error message string and loosens the matching in tests. It does not alter any security logic, parsing behavior, or access controls. There is no indication this fixes or introduces a security issue.
No security action required. Treat as routine code/test maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change differentiates error messages for malformed CBOR by appending ‘(malformed)’ to the existing ‘Invalid RPC Request message’ string. The test file is updated to use startswith() instead of exact equality. No code paths, validation logic, or memory handling are modified.
Changed components
main/wire.ctest_jade.pyInspect captured patch +6 / −6
diff --git a/main/wire.c b/main/wire.c
index e3ea853..e4cde93 100644
--- a/main/wire.c
+++ b/main/wire.c
@@ -130,7 +130,7 @@ static void handle_data_impl(uint8_t* full_data_in, size_t* read_ptr, bool rejec
if (!rpc_request_valid(&ctx.value)) {
// bad message - expect all inputs to be cbor with a root map with an id and a method strings keys values
JADE_LOGW("Invalid request, length %u", msg_len);
- SEND_REJECT_MSG(CBOR_RPC_INVALID_REQUEST, "Invalid RPC Request message", msg_len);
+ SEND_REJECT_MSG(CBOR_RPC_INVALID_REQUEST, "Invalid RPC Request message (malformed)", msg_len);
} else if (handleImmediateMessage(&ctx)) {
JADE_LOGI("Message handled, not passing to main task");
idletimer_register_activity(false);
diff --git a/test_jade.py b/test_jade.py
index 381e846..6ef98ff 100644
--- a/test_jade.py
+++ b/test_jade.py
@@ -712,7 +712,7 @@ def test_bad_message(jade):
assert 'result' not in reply
error = reply['error']
assert error['code'] == JadeError.INVALID_REQUEST
- assert error['message'] == 'Invalid RPC Request message'
+ assert error['message'].startswith('Invalid RPC Request message')
assert int(error['data']) == len(msgbytes)
assert 'result' not in reply
@@ -743,7 +743,7 @@ def test_very_bad_message(jade):
# Assert bad message response
error = reply['error']
assert error['code'] == JadeError.INVALID_REQUEST
- assert error['message'] == 'Invalid RPC Request message'
+ assert error['message'].startswith('Invalid RPC Request message')
bad_bytes += int(error['data'])
assert bad_bytes == len(badmsg)
@@ -779,7 +779,7 @@ def test_random_bytes(jade):
reply = jade.read_response()
error = reply['error']
assert error['code'] == JadeError.INVALID_REQUEST
- assert error['message'] == 'Invalid RPC Request message'
+ assert error['message'].startswith('Invalid RPC Request message')
nreceived += int(error['data'])
assert nreceived == nsent
@@ -832,7 +832,7 @@ def test_too_much_input(jade, has_psram):
reply = jade.read_response()
error = reply['error']
assert error['code'] == JadeError.INVALID_REQUEST
- assert error['message'] == 'Invalid RPC Request message'
+ assert error['message'].startswith('Invalid RPC Request message')
assert int(error['data']) == expected_buffer_size
# After a short pause send a good message
@@ -849,7 +849,7 @@ def test_too_much_input(jade, has_psram):
reply = jade.read_response()
error = reply['error']
assert error['code'] == JadeError.INVALID_REQUEST
- assert error['message'] == 'Invalid RPC Request message'
+ assert error['message'].startswith('Invalid RPC Request message')
bad_bytes += int(error['data'])
assert bad_bytes == expected_overflow_len
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.