jadepy: support new/old versions of cbor2
What the developer wrote
Authored by Jon Griffiths
jadepy: support new/old versions of cbor2
Based on a change from @1-21gigasats.
cbor2 b0rkage seems assured while it transitions its underlying
implementation. Supply a workaround for library interface changes,
as distateful as requiring it is.
What changed, and why it matters
This is a small compatibility fix for the Python Jade library so it works with both older and newer versions of the cbor2 serialization library. Newer cbor2 changed which exception it raises when data runs out, so the code now detects the available exception type and catches the right one. It is a robustness improvement rather than a fix for an active security vulnerability.
Treat as a routine compatibility/robustness patch. Users packaging Jade should ensure cbor2 version constraints allow both old and new implementations, and verify that timeout and disconnect scenarios still raise the expected exception. No urgent security deployment is indicated by this commit alone.
Security signals we found
Exception-handling compatibility fix for dependency API drift
Potential for missed error conditions if wrong exception class is caught
No direct memory corruption, cryptographic, or authentication issue visible in diff
Evidence from the diff
The commit updates jadepy/jade.py to handle a breaking API change in cbor2. Older cbor2 raises EOFError on decode EOF; newer versions raise cbor.CBORDecodeEOF. The patch stores the available exception class in self.EOFError and catches that instead of the bare EOFError. This prevents legitimate end-of-stream/timeout/lost-connection conditions from being treated as unexpected errors or, conversely, unexpected errors from being silently swallowed. The change is defensive and improves reliability across dependency versions.
Changed components
jadepy/jade.pyJadeInterface.read_cbor_message()JadeInterface.read_cbor_message_over_serial()cbor2 dependency integrationInspect captured patch +4 / −2
diff --git a/jadepy/jade.py b/jadepy/jade.py
index fa72030..bfbbd0d 100644
--- a/jadepy/jade.py
+++ b/jadepy/jade.py
@@ -2069,6 +2069,8 @@ class JadeInterface:
def __init__(self, impl):
assert impl is not None
self.impl = impl
+ # Support older cbor2 versions that return EOFError
+ self.EOFError = getattr(cbor, 'CBORDecodeEOF', EOFError)
def __enter__(self):
self.connect()
@@ -2358,7 +2360,7 @@ class JadeInterface:
"""
while True:
# 'self' is sufficiently 'file-like' to act as a load source.
- # Throws EOFError on end of stream/timeout/lost-connection etc.
+ # Throws self.EOFError on end of stream/timeout/lost-connection etc.
message = cbor.load(self)
if isinstance(message, collections.abc.Mapping):
@@ -2415,7 +2417,7 @@ class JadeInterface:
while True:
try:
return self.read_cbor_message()
- except EOFError as _:
+ except self.EOFError as _:
if not long_timeout:
raise
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.