From 82d9616f1b42c3f24c1a9eda64c774d248c0bde1 Mon Sep 17 00:00:00 2001 From: "J. Nick Koston" Date: Sun, 8 Feb 2026 07:18:29 -0600 Subject: [PATCH] Add explicit binascii.Error catch and bad-padding test binascii.Error is already a subclass of ValueError, but listing it explicitly makes the intent clear. Added test for incorrect base64 padding (e.g. "Basic abc"). --- esphome/dashboard/web_server.py | 2 +- tests/dashboard/test_web_server.py | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/esphome/dashboard/web_server.py b/esphome/dashboard/web_server.py index 52e16e1ad7d..3f29e54d24e 100644 --- a/esphome/dashboard/web_server.py +++ b/esphome/dashboard/web_server.py @@ -123,7 +123,7 @@ def is_authenticated(handler: BaseHandler) -> bool: try: auth_decoded = base64.b64decode(auth_header[6:]).decode() username, password = auth_decoded.split(":", 1) - except (ValueError, UnicodeDecodeError): + except (binascii.Error, ValueError, UnicodeDecodeError): return False return settings.check_password(username, password) return handler.get_secure_cookie(AUTH_COOKIE_NAME) == COOKIE_AUTHENTICATED_YES diff --git a/tests/dashboard/test_web_server.py b/tests/dashboard/test_web_server.py index 985efa31571..66497088fb8 100644 --- a/tests/dashboard/test_web_server.py +++ b/tests/dashboard/test_web_server.py @@ -1707,6 +1707,14 @@ def test_is_authenticated_malformed_base64( assert web_server.is_authenticated(handler) is False +def test_is_authenticated_bad_base64_padding( + mock_auth_settings: MagicMock, +) -> None: + """Test that incorrect base64 padding (binascii.Error) returns False.""" + handler = _make_auth_handler("Basic abc") + assert web_server.is_authenticated(handler) is False + + def test_is_authenticated_invalid_utf8( mock_auth_settings: MagicMock, ) -> None: