Merge pull request #1421 from alex/fix-bug

Fixed an issue in fernet where the wrong exception would occur on an all-nulls input.

2 files changed, 8 insertions, 3 deletions

diff --git a/cryptography/fernet.py b/cryptography/fernet.py
index cdb9bdca..a8e0330e 100644
--- a/cryptography/fernet.py
+++ b/cryptography/fernet.py
@@ -90,7 +90,7 @@ class Fernet(object):
         except (TypeError, binascii.Error):
             raise InvalidToken
 
-        if six.indexbytes(data, 0) != 0x80:
+        if not data or six.indexbytes(data, 0) != 0x80:
             raise InvalidToken
 
         try:
diff --git a/tests/test_fernet.py b/tests/test_fernet.py
index 0683d950..0b4e3e87 100644
--- a/tests/test_fernet.py
+++ b/tests/test_fernet.py
@@ -86,15 +86,20 @@ class TestFernet(object):
             f.decrypt(token.encode("ascii"), ttl=ttl_sec)
 
     def test_invalid_start_byte(self, backend):
-        f = Fernet(Fernet.generate_key(), backend=backend)
+        f = Fernet(base64.urlsafe_b64encode(b"\x00" * 32), backend=backend)
         with pytest.raises(InvalidToken):
             f.decrypt(base64.urlsafe_b64encode(b"\x81"))
 
     def test_timestamp_too_short(self, backend):
-        f = Fernet(Fernet.generate_key(), backend=backend)
+        f = Fernet(base64.urlsafe_b64encode(b"\x00" * 32), backend=backend)
         with pytest.raises(InvalidToken):
             f.decrypt(base64.urlsafe_b64encode(b"\x80abc"))
 
+    def test_non_base64_token(self, backend):
+        f = Fernet(base64.urlsafe_b64encode(b"\x00" * 32), backend=backend)
+        with pytest.raises(InvalidToken):
+            f.decrypt(b"\x00")
+
     def test_unicode(self, backend):
         f = Fernet(base64.urlsafe_b64encode(b"\x00" * 32), backend=backend)
         with pytest.raises(TypeError):