gh-155426: correctly accept bytes-like keys in hmac.digest

picnixz · picnixz · commit fe28b3095506 · 2026-08-09T14:10:11.000+02:00
This only affects keys of length smaller than the HMAC blocksize
since larger keys are hashed first.
diff --git a/Lib/hmac.py b/Lib/hmac.py
@@ -275,6 +275,8 @@ def _compute_digest_fallback(key, msg, digest):
     blocksize = getattr(inner, 'block_size', 64)
     if len(key) > blocksize:
         key = digest_cons(key).digest()
+    if not (hasattr(key, "ljust") and hasattr(key, "translate")):
+        key = bytes(key)
     key = key.ljust(blocksize, b'\0')
     inner.update(key.translate(trans_36))
     outer.update(key.translate(trans_5C))
diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
@@ -1459,6 +1459,11 @@ class OperatorCompareDigestTestCase(CompareDigestMixin, unittest.TestCase):
 class PyMiscellaneousTests(unittest.TestCase):
     """Miscellaneous tests for the pure Python HMAC module."""
 
+    @staticmethod
+    def mock__compute_digest_fallback(hmac):
+        fn = getattr(hmac, meth := "_compute_digest_fallback")
+        return patch.object(hmac, meth, autospec=True, wraps=fn)
+
     @hashlib_helper.requires_builtin_hmac()
     def test_hmac_constructor_uses_builtin(self):
         # Block the OpenSSL implementation and check that
@@ -1519,6 +1524,15 @@ def test_with_fallback(self):
         finally:
             cache.pop('foo')
 
+    @hashlib_helper.requires_hashdigest("md5")
+    def test_hmac_digest_accept_memoryview_for_key(self):
+        hmac = import_fresh_module("hmac", blocked=["_hashlib", "_hmac"])
+        with self.mock__compute_digest_fallback(hmac) as slow:
+            # The bytes(...) path is only meant for small keys. Large
+            # keys are already coerced to bytes since they are hased.
+            hmac.digest(memoryview(b"small"), b"world", "md5")
+            slow.assert_called_once()
+
     @hashlib_helper.requires_openssl_hashdigest("md5")
     @bigmemtest(size=_4G + 5, memuse=2, dry_run=False)
     def test_hmac_digest_overflow_error_openssl_only(self, size):
@@ -1542,11 +1556,11 @@ def do_test_hmac_digest_overflow_error_switch_to_slow(self, hmac, size):
         bigkey = b'K' * size
         bigmsg = b'M' * size
 
-        with patch.object(hmac, "_compute_digest_fallback") as slow:
+        with self.mock__compute_digest_fallback(hmac) as slow:
             hmac.digest(bigkey, b'm', "md5")
             slow.assert_called_once()
 
-        with patch.object(hmac, "_compute_digest_fallback") as slow:
+        with self.mock__compute_digest_fallback(hmac) as slow:
             hmac.digest(b'k', bigmsg, "md5")
             slow.assert_called_once()
 
@@ -1556,10 +1570,12 @@ def test_hmac_digest_no_overflow_error_in_fallback(self, size):
         hmac = import_fresh_module("hmac", blocked=["_hashlib", "_hmac"])
 
         for key, msg in [(b'K' * size, b'm'), (b'k', b'M' * size)]:
-            with self.subTest(keysize=len(key), msgsize=len(msg)):
-                with patch.object(hmac, "_compute_digest_fallback") as slow:
-                    hmac.digest(key, msg, "md5")
-                    slow.assert_called_once()
+            with (
+                self.subTest(keysize=len(key), msgsize=len(msg)),
+                self.mock__compute_digest_fallback(hmac) as slow,
+            ):
+                hmac.digest(key, msg, "md5")
+                slow.assert_called_once()
 
 
 class BuiltinMiscellaneousTests(BuiltinModuleMixin, unittest.TestCase):
diff --git a/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
@@ -0,0 +1,3 @@
+Make sure that the pure Python fallback of :func:`hmac.digest` accept
+bytes-like keys and not just :class:`bytes` instances. Patch by Bénédikt
+Tran.

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	+Make sure that the pure Python fallback of :func:`hmac.digest` accept
	`2`	+bytes-like keys and not just :class:`bytes` instances. Patch by Bénédikt
	`3`	`+Tran.`