From 7daa27f035c4844b0d5e5536a445875018218612 Mon Sep 17 00:00:00 2001
From: Kayvan Zahiri <123409429+Kayvan-Zahiri@users.noreply.github.com>
Date: Fri, 23 Oct 2026 13:09:56 -0700
Subject: [PATCH] fix: reject non-ASCII webhook signatures without raising

---
 flagsmith/webhooks.py  | 3 +++
 tests/test_webhooks.py | 8 ++++++++
 2 files changed, 11 insertions(+)

diff --git a/flagsmith/webhooks.py b/flagsmith/webhooks.py
index ab31ca2..d102117 100644
--- a/flagsmith/webhooks.py
+++ b/flagsmith/webhooks.py
@@ -37,5 +37,8 @@ def verify_signature(
     :param shared_secret: The shared secret configured for this specific webhook.
     :return: True if the signature is valid, False otherwise.
     """
+    if not received_signature.isascii():
+        return False
+
     expected_signature = generate_signature(request_body, shared_secret)
     return hmac.compare_digest(expected_signature, received_signature)
diff --git a/tests/test_webhooks.py b/tests/test_webhooks.py
index 5ac7ea6..7cc814b 100644
--- a/tests/test_webhooks.py
+++ b/tests/test_webhooks.py
@@ -1,5 +1,7 @@
 import json
 
+import pytest
+
 from flagsmith.webhooks import generate_signature, verify_signature
 
 
@@ -48,3 +50,9 @@ def test_verify_signature_invalid() -> None:
         received_signature="bad",
         shared_secret="?",
     )
+
+
+@pytest.mark.parametrize("signature", ["é", "🔒", "a" * 63 + "é", "\ud800"])
+@pytest.mark.parametrize("body", ["{}", b"{}"])
+def test_verify_signature_rejects_non_ascii(signature: str, body: str | bytes) -> None:
+    assert verify_signature(body, signature, "secret") is False