Add regression test for non-object JSON message-sign input
What the developer wrote
Authored by copilot-swe-agent[bot]
Add regression test for non-object JSON message-sign input
Test requested in review on Coldcard/firmware#808: valid JSON that is not
an object (or lacks the "msg" key) must produce a clean failure story,
never a device crash.
Co-authored-by: Amiga500 <16525337+Amiga500@users.noreply.github.com>
What changed, and why it matters
This commit only adds a new automated test to the COLDCARD firmware test suite. The test checks that when a user tries to sign a text file containing valid JSON that is not a JSON object (for example, a plain number, string, null, or list), or a JSON object missing the required 'msg' key, the device shows a clean error message instead of crashing. The commit itself does not change any firmware code, so it does not fix or introduce a vulnerability directly. It is a regression test requested during review of an earlier change, likely to make sure a previous fix stays effective.
Treat this as a test-hardening commit rather than a security patch. Review the associated pull request #808 and the production code path it exercises to confirm the crash-avoidance behavior is already implemented in firmware. If the underlying fix is not yet merged, the test alone does not protect users. Consider adding equivalent tests for other edge cases such as empty files, non-JSON content, and very large inputs.
Security signals we found
Regression test for input validation of JSON message-signing
Test comment explicitly references avoiding a device crash on malformed JSON input
Test requested during review of pull request #808, suggesting prior related code change
No firmware code patched; test-only commit
Evidence from the diff
The diff adds a parametrized pytest in testing/test_msg.py named test_sign_msg_json_not_object. It writes various JSON bodies to a MicroSD file and exercises the ‘Sign Text File’ menu flow. For non-object JSON values (123, ‘hello’, null, [1,2]) it expects the signing prompt to appear (treated as plain message text). For an object missing the ‘msg’ key ({‘nomsg’: 1}) it expects a failure story containing ‘MSG required’, ‘must be ascii’, or ‘too short’. The test’s own comment says the goal is to ensure ‘never a crash (yikes)’, implying a prior concern that malformed JSON input could crash the device. No firmware source is modified.
Changed components
testing/test_msg.pyMessage signing JSON input handling (indirectly tested)Inspect captured patch +32 / −0
### testing/test_msg.py
@@ -1133,4 +1133,36 @@ def test_verify_scanned_signed_msg(msg, scan_a_qr, need_keypress, goto_home, cap
assert "Good signature by address" in story
assert addr == addr_from_display_format(story.split("\n")[-1])
+
+@pytest.mark.parametrize('body,fail', [
+ ('123', False), # valid JSON, int
+ ('"hello"', False), # valid JSON, string
+ ('null', False), # valid JSON, null
+ ('[1,2]', False), # valid JSON, list
+ # all above treated as just message
+ ('{"nomsg": 1}', True), # object but missing "msg" key
+])
+def test_sign_msg_json_not_object(body, fail, open_microsd, microsd_path, goto_home,
+ pick_menu_item, cap_story):
+
+ # valid JSON that is not an object (or lacks "msg") must produce a clean
+ # failure story, never a crash (yikes)
+ fname = 't-msgsign-bad.json'
+ with open_microsd(fname, 'wt') as sd:
+ sd.write(body)
+
+ goto_home()
+ pick_menu_item('Advanced/Tools')
+ pick_menu_item('File Management')
+ pick_menu_item('Sign Text File')
+ time.sleep(.1)
+ pick_menu_item(fname)
+ time.sleep(.1)
+ title, story = cap_story()
+ if fail:
+ assert not story.startswith('Ok to sign this?')
+ assert 'MSG required' in story or 'must be ascii' in story or 'too short' in story
+ else:
+ assert story.startswith('Ok to sign this?')
+
# EOFWhy this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.