fix: 8 bug fixes — sensor data loss, SSL bypass, JSON injection, ZeroDivisionError, and more#145
Open
KJonline wants to merge 10 commits into
Open
fix: 8 bug fixes — sensor data loss, SSL bypass, JSON injection, ZeroDivisionError, and more#145KJonline wants to merge 10 commits into
KJonline wants to merge 10 commits into
Conversation
- Replace __class__.__name__ string checks with direct error.response parsing for boto3 ClientError - Remove redundant if checks when re-raising EndpointConnectionError as HiveApiError - Defer asyncio.get_event_loop() call to async_init() using get_running_loop() - Remove deprecated pool_region parameter from HiveAuthAsync.__init__ - Add HiveError base class and reorganize exception hierarchy (HiveConfigurationError, HiveAuthCredentialError)
…VE_TYPES branch Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… get_password_authentication_key Import HiveUnknownConfiguration and raise it instead of letting AttributeError propagate when REGION or UPID are absent from the SSO login info response, and when _pool_id is None or missing an underscore in get_password_authentication_key. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Extend the except clause in get_min_color_temp, get_max_color_temp, and get_color_temp from KeyError-only to (KeyError, ZeroDivisionError) so that a zero colourTemperature value returned by the Hive API returns None instead of raising an unhandled ZeroDivisionError. Tests added for all three cases. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…hardcoding it Removes the line that overwrote the caller-supplied `pattern` with a hardcoded Hive format string, so custom format strings are respected. Adds TestEpochTimePattern tests to confirm the fix and prevent regression. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…n.dumps in set_state - Replace manual string-concatenation JSON building in set_state with json.dumps(kwargs) to prevent JSON injection when kwarg values contain double-quotes or backslashes - Remove requests.get(verify=False) SSL bypass from get_login_info - Remove urllib3 import and disable_warnings call that suppressed the SSL warning - Update TestGetLoginInfo assertion to match new call signature (no verify=False) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…nd dead url/status guard Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… returning True Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… SessionConfig type Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sensor.py:160):HIVE_TYPES["Sensor"]branch was keying intodata.deviceswithhive_idinstead ofdevice_id, causingdevice_data,props, andparent_deviceto always be empty for contact/motion sensorshive_async_api.py): Removedverify=FalseSSL bypass andurllib3.disable_warnings; replaced string-concatenated JSON payload inset_statewithjson.dumpsto eliminate injection riskcolor.py): Colour-temperature conversion methods silently swallowedKeyErrorbut notZeroDivisionError— addedZeroDivisionErrorto all threeexceptclauseshive_auth_async.py):async_initandget_password_authentication_keycalled.split()on values from.get()without guarding againstNone; now raisesHiveUnknownConfigurationwith a descriptive messageepoch_time(hive_helper.py): Theto_epochbranch hardcoded its own pattern, ignoring thepatternargument passed by the callerupdateIntervalno-op (compat_aliases.py): The HA backwards-compat alias was silently returningTruewithout updatingconfig.scan_interval; now correctly setstimedelta(seconds=new_interval)srp_crypto.py,hive_async_api.py): UnusedThreadPoolExecutorpool (spawned threads on import), deprecatedrefresh_tokensmethod and its tests, deadif url is not Noneguardheating.py,hotwater.py,boost.py): Bare_LOGGER.error(e)calls now include method name and device nameTest Plan
pytest tests/— 956 passed, 99.17% coverage (above 99% threshold)test_polling.py::TestGetDevicesSlowPoll::test_auth_error_sets_last_poll_slow_false— predates this branch, unrelated to these changes🤖 Generated with Claude Code