← Watch feed
tests: migrate pin action tests from test_jade to rpc tests
Public commit record
60/100 · Adequate
What the developer wrote
Authored by Mike Tolkachev
tests: migrate pin action tests from test_jade to rpc tests
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
What changed, and why it matters
This commit simply moves existing test cases from one test file to another. It does not change any production code, security behavior, or fix any vulnerability. The tests check that the Jade device correctly rejects invalid parameters for PIN-related actions, but those checks already existed before this change.
Recommended action
No security action needed; this is a test-only refactor. Continue normal review/CI processes.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is a pure test refactor: bad-parameter test vectors for ‘auth_user’ and ‘update_pinserver’ RPC methods are removed from test_jade.py and added to tests/rpc/test_pin_actions.py, with minor syntactic updates (e.g., using bytes.fromhex instead of h2b). No firmware or library code is modified, and no security boundary is altered.
Changed components
test_jade.pytests/rpc/test_pin_actions.pyInspect captured patch +42 / −40
### test_jade.py
@@ -633,46 +633,7 @@ def test_bad_params(jade):
assert len(trezor_id_test) == 1
GOOD_ECDH_PUBKEY = trezor_id_test[0]['expected_output']['slip-0017']
- bad_params = [(('badauth1', 'auth_user'), 'Expecting parameters map'),
- (('badauth2', 'auth_user', {'network': None}), 'extract valid network'),
- (('badauth3', 'auth_user', {'network': 1234512345}), 'extract valid network'),
- (('badauth4', 'auth_user', {'network': ''}), 'extract valid network'),
- (('badauth5', 'auth_user', {'network': 'notanetwork'}), 'extract valid network'),
- (('badauth6', 'auth_user', {'network': 'testnet', 'epoch': 'notanumber'}),
- 'valid epoch value'),
- (('badauth7', 'auth_user', {'network': 'testnet', 'epoch': 12345.6789}),
- 'valid epoch value'),
-
- (('badpin1', 'update_pinserver'), 'Expecting parameters map'),
- (('badpin2', 'update_pinserver',
- {'urlA': ''}), 'invalid first URL'),
- (('badpin3', 'update_pinserver',
- {'urlA': '192.168.1.123'}), 'invalid first URL'),
- (('badpin4', 'update_pinserver',
- {'urlA': 'ftp://192.168.1.123'}), 'invalid first URL'),
- (('badpin5', 'update_pinserver',
- {'urlA': 'http://192.168.1.123', 'urlB': 'testurl.com:8080'}),
- 'Invalid second URL'),
- (('badpin6', 'update_pinserver',
- {'urlA': 'http://192.168.1.123', 'urlB': 'madeup://testurl.com:8080'}),
- 'Invalid second URL'),
- (('badpin7', 'update_pinserver',
- {'urlB': 'https://192.168.1.124'}), 'set only second URL'),
- (('badpin8', 'update_pinserver',
- {'urlA': 'http://192.168.1.123', 'urlB': 'https://192.168.1.124',
- 'reset_details': True}), 'set and reset details'),
- (('badpin9', 'update_pinserver',
- {'pubkey': h2b('abc123'), 'reset_details': True}), 'set and reset details'),
- (('badpin10', 'update_pinserver',
- {'pubkey': h2b('abcdef')}), 'set pubkey without URL'),
- (('badpin11', 'update_pinserver',
- {'urlA': 'http://192.168.1.123', 'urlB': 'https://192.168.1.124',
- 'pubkey': h2b('abcdef1234')}), 'Invalid Oracle pubkey'),
- (('badpin12', 'update_pinserver',
- {'certificate': 'testcert', 'reset_certificate': True}),
- 'set and reset certificate'),
-
- (('badent1', 'add_entropy'), 'Expecting parameters map'),
+ bad_params = [(('badent1', 'add_entropy'), 'Expecting parameters map'),
(('badent2', 'add_entropy', {'entropy': None}), 'valid entropy bytes'),
(('badent3', 'add_entropy', {'entropy': 1234512345}), 'valid entropy bytes'),
(('badent4', 'add_entropy', {'entropy': b''}), 'valid entropy bytes'),
### tests/rpc/test_pin_actions.py
@@ -139,6 +139,47 @@ def pin_test_setup(pin_lifecycle):
return jade, storage, pinserver
+BAD_PIN_PARAMETERS = [
+ ('badauth1', 'auth_user', None, 'Expecting parameters map'),
+ ('badauth2', 'auth_user', {'network': None}, 'extract valid network'),
+ ('badauth3', 'auth_user', {'network': 1234512345}, 'extract valid network'),
+ ('badauth4', 'auth_user', {'network': ''}, 'extract valid network'),
+ ('badauth5', 'auth_user', {'network': 'notanetwork'}, 'extract valid network'),
+ ('badauth6', 'auth_user', {'network': 'testnet', 'epoch': 'notanumber'}, 'valid epoch'),
+ ('badauth7', 'auth_user', {'network': 'testnet', 'epoch': 12345.6789}, 'valid epoch'),
+ ('badpin1', 'update_pinserver', None, 'Expecting parameters map'),
+ ('badpin2', 'update_pinserver', {'urlA': ''}, 'invalid first URL'),
+ ('badpin3', 'update_pinserver', {'urlA': '192.168.1.123'}, 'invalid first URL'),
+ ('badpin4', 'update_pinserver', {'urlA': 'ftp://192.168.1.123'}, 'invalid first URL'),
+ ('badpin5', 'update_pinserver', {'urlA': 'http://192.168.1.123',
+ 'urlB': 'testurl.com:8080'}, 'Invalid second URL'),
+ ('badpin6', 'update_pinserver', {'urlA': 'http://192.168.1.123',
+ 'urlB': 'madeup://testurl.com:8080'}, 'Invalid second URL'),
+ ('badpin7', 'update_pinserver', {'urlB': 'https://192.168.1.124'}, 'set only second URL'),
+ ('badpin8', 'update_pinserver', {'urlA': 'http://192.168.1.123',
+ 'urlB': 'https://192.168.1.124',
+ 'reset_details': True}, 'set and reset details'),
+ ('badpin9', 'update_pinserver', {'pubkey': bytes.fromhex('abc123'),
+ 'reset_details': True}, 'set and reset details'),
+ ('badpin10', 'update_pinserver', {'pubkey': bytes.fromhex('abcdef')}, 'pubkey without URL'),
+ ('badpin11', 'update_pinserver', {'urlA': 'http://192.168.1.123',
+ 'urlB': 'https://192.168.1.124',
+ 'pubkey': bytes.fromhex('abcdef')}, 'Invalid Oracle pubkey'),
+ ('badpin12', 'update_pinserver', {'certificate': 'testcert',
+ 'reset_certificate': True}, 'set and reset certificate'),
+]
+
+
+def test_bad_pin_action_parameters(jade):
+ for request_id, method, params, expected_message in BAD_PIN_PARAMETERS:
+ request = jade.jade.build_request(request_id, method, params)
+ reply = jade.jade.make_rpc_call(request)
+ assert reply['id'] == request_id
+ assert 'result' not in reply
+ assert reply['error']['code'] == JadeError.BAD_PARAMETERS
+ assert expected_message in reply['error']['message']
+
+
def test_pin_requires_auth_user(jade):
request = jade.jade.build_request('pin_no_auth', 'pin', {'data': 'unused'})
reply = jade.jade.make_rpc_call(request)Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.