🛡️ Sentinel: [CRITICAL] hmac.compare_digest의 처리되지 않은 TypeError로 인한 DoS 수정

.jules/sentinel.md

@@ -65,3 +65,8 @@
 **Vulnerability:** Path traversal in `media_shrinker.py` via unresolved `..` segments or symlink escapes before deriving conversion output paths.
 **Learning:** `Path.relative_to()` is only a lexical containment check unless both the source and root have first been resolved into canonical absolute paths. Relative paths and symlinks can otherwise bypass root-boundary assumptions.
 **Prevention:** Resolve both source and root once, reject sources outside the resolved root with a sanitized `MediaShrinkerError`, and derive `rel_source` from the resolved paths before planning outputs.
+
+## 2026-07-15 - [Sentinel: DoS via HMAC Compare Digest TypeError]
+**Vulnerability:** Denial of Service (DoS) vulnerability via unhandled TypeError when providing non-ASCII API keys to `hmac.compare_digest`.
+**Learning:** `hmac.compare_digest` in Python raises a `TypeError` when comparing strings containing non-ASCII characters. Passing untrusted, unencoded headers directly to this function can lead to unhandled exceptions and service crashes. FastAPI/Starlette decodes headers to `latin1` strings.
+**Prevention:** Always encode both arguments passed to `hmac.compare_digest` to bytes before comparison, specifically using `.encode('latin1', errors='replace')` when dealing with FastAPI/Starlette decoded HTTP headers.

saas_web.py

@@ -114,7 +114,7 @@ async def require_api_key(request: Request, call_next):
     if configured_keys and not (request.method == "GET" and request.url.path == "/"):
         provided_key = request.headers.get("x-api-key", "")
         if not any(
-            hmac.compare_digest(provided_key, key) for key in configured_keys
+            hmac.compare_digest(provided_key.encode("latin1", errors="replace"), key.encode("latin1", errors="replace")) for key in configured_keys
         ):
             return JSONResponse(
                 status_code=401,

tests/test_saas_web.py

@@ -186,6 +186,17 @@ def test_shrink_media_rejects_nonpositive_target_bytes(self):
             {"error": "Invalid target_bytes value. Must be greater than 0."},
         )
 
+    def test_non_ascii_api_key_does_not_crash(self):
+        with patch.dict(os.environ, {"CODEC_CARVER_API_KEYS": "secret-key"}):
+            response = client.post(
+                "/shrink",
+                files={"file": ("input.wav", io.BytesIO(b"dummy wav data"), "audio/wav")},
+                data={"target_bytes": 0},
+                headers=[(b"x-api-key", "한글".encode("utf-8"))],
+            )
+        self.assertEqual(response.status_code, 401)
+        self.assertEqual(response.json(), {"error": "Invalid or missing API key"})
+
     def test_shrink_media_rejects_missing_filename(self):
         response = saas_web.shrink_media(
             BackgroundTasks(),