Solution randomly not valid

[nijel]

While writing tests for altcha based form validation, I've noticed that the tests randomly fail.

This is code extracted from our testcase:

import base64
import json

from altcha import ChallengeOptions, create_challenge, solve_challenge, verify_solution


def test():
    secret = "x" * 16
    challenge_options = ChallengeOptions(
        hmac_key=secret,
        max_number=100,
    )
    challenge = create_challenge(challenge_options)
    solution = solve_challenge(
        challenge=challenge.challenge,
        salt=challenge.salt,
        algorithm=challenge.algorithm,
        max_number=challenge.maxnumber,
        start=0,
    )

    response = base64.b64encode(
        json.dumps(
            {
                "algorithm": challenge.algorithm,
                "challenge": challenge.challenge,
                "number": solution.number,
                "salt": challenge.salt,
                "signature": challenge.signature,
            }
        ).encode("utf-8")
    ).decode("utf-8")
    result = verify_solution(response, secret, check_expires=False)
    if not result[0]:
        raise ValueError("Invalid solution")


if __name__ == "__main__":
    for i in range(1000):
        test()

Is there something wrong in the tests? Why do we get randomly invalid solutions?

[ovx]

Hi, this was a bug on this line in create_challenge, which generates a random one when options.number=0:

number = options.number or secrets.randbelow(max_number)

The number parameter is in the range of 0...max_number inclusive -> it must support zero as a valid solution. Also since secrets.randbelow generates number exclusive of the max_number, added +1 for the upper limit.

Fixes in version 0.1.7.