tests: test splitting the write for concatenated messages
What the developer wrote
Authored by Jon Griffiths
tests: test splitting the write for concatenated messages
What changed, and why it matters
This commit only adds a new test case to the project's test file. It does not change any production code, fix a bug, or alter device behavior. The test checks that a hardware wallet correctly handles two messages sent back-to-back, even when the data is split across two writes and when a delay is inserted between the writes. There is no security issue in this change itself.
No action required. This is a test-only change. Review the corresponding production code handling of split/concatenated messages separately if concerned, but this commit does not introduce or fix a vulnerability.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies test_jade.py to extend test_concatenated_messages. Previously, the test sent two CBOR-encoded messages in a single write. Now it splits the concatenated CBOR bytes at a random point, sends them as two separate writes, and optionally waits 5 seconds between writes to force a timeout/stale condition. The test is then invoked twice in the test runner: once without waiting and once with waiting. No firmware, protocol, or library code is changed.
Changed components
test_jade.pyInspect captured patch +10 / −3
diff --git a/test_jade.py b/test_jade.py
index 754b06d..02dc195 100644
--- a/test_jade.py
+++ b/test_jade.py
@@ -910,12 +910,18 @@ def test_split_message(jade):
assert 'result' in reply and len(reply['result']) == NUM_VALUES_VERINFO
-def test_concatenated_messages(jade):
+def test_concatenated_messages(jade, do_wait):
# Simulate a 'bad' client sending two messages without waiting for a reply
msg1 = {'method': 'get_version_info', 'id': '123456'}
msg2 = {'method': 'get_version_info', 'id': '456789'}
concat_cbor = cbor.dumps(msg1) + cbor.dumps(msg2)
- jade.write(concat_cbor)
+ # Split the write of the messages in two at a random point
+ split_point = random.randint(1, len(concat_cbor) - 1)
+ jade.write(concat_cbor[:split_point])
+ if do_wait:
+ # Force the first write to timeout (become stale)
+ wait(5, force=True)
+ jade.write(concat_cbor[split_point:])
reply1 = jade.read_response()
reply2 = jade.read_response()
@@ -4011,7 +4017,8 @@ def run_interface_tests(jadeapi,
test_very_bad_message(jadeapi.jade)
test_bad_message(jadeapi.jade)
test_split_message(jadeapi.jade)
- test_concatenated_messages(jadeapi.jade)
+ test_concatenated_messages(jadeapi.jade, do_wait=False)
+ test_concatenated_messages(jadeapi.jade, do_wait=True)
test_unknown_method(jadeapi.jade)
test_unexpected_method(jadeapi.jade)
test_bad_params(jadeapi.jade)
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.