diff --git a/src/cryptography/fernet.py b/src/cryptography/fernet.py index c2e01fc50..a3c9ca61d 100644 --- a/src/cryptography/fernet.py +++ b/src/cryptography/fernet.py @@ -30,7 +30,12 @@ class Fernet(object): key: typing.Union[bytes, str], backend: typing.Any = None, ): - key = base64.urlsafe_b64decode(key) + try: + key = base64.urlsafe_b64decode(key) + except binascii.Error as exc: + raise ValueError( + "Fernet key must be 32 url-safe base64-encoded bytes." + ) from exc if len(key) != 32: raise ValueError( "Fernet key must be 32 url-safe base64-encoded bytes." diff --git a/tests/test_fernet.py b/tests/test_fernet.py index d3090e04c..5db21f523 100644 --- a/tests/test_fernet.py +++ b/tests/test_fernet.py @@ -130,9 +130,10 @@ class TestFernet(object): f = Fernet(Fernet.generate_key(), backend=backend) assert f.decrypt(f.encrypt(message)) == message - def test_bad_key(self, backend): + @pytest.mark.parametrize("key", [base64.urlsafe_b64encode(b"abc"), b"abc"]) + def test_bad_key(self, backend, key): with pytest.raises(ValueError): - Fernet(base64.urlsafe_b64encode(b"abc"), backend=backend) + Fernet(key, backend=backend) def test_extract_timestamp(self, monkeypatch, backend): f = Fernet(base64.urlsafe_b64encode(b"\x00" * 32), backend=backend)