Repository navigation
mavgen_javascript: fix signing replay timestamp updates - #1329
Open
Johnny-Kao wants to merge 1 commit into
Open
Johnny-Kao wants to merge 1 commit into
Johnny-Kao wants to merge 1 commit into
Conversation
Johnny-Kao
marked this pull request as ready for review
November 6, 2026 13:54
Move per-stream timestamp updates after successful signature verification, so invalid signatures cannot poison replay state and accepted packets advance the replay barrier. Signed-off-by: Johnny Kao <19386515+Johnny-Kao@users.noreply.github.com>
Johnny-Kao
force-pushed
the
fix/js-signing-replay-state
branch
from
November 6, 2026 14:06
74bb942 to
eba49a8
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi, this is my first contribution to pymavlink.
I noticed that the JavaScript_NextGen generator has a similar signing issue to the one fixed in #1301.
There are two related problems:
I moved the timestamp update to after successful signature verification, following the approach used in #1301.
The change is small and does not modify the public API or MAVLink message format.
I also added regression tests using the project's existing pytest and JavaScript test helpers. The original generator fails these tests, while the updated version passes. The existing JavaScript/C integration tests and 2,983 Mocha tests passed in staging as well.
Staging checks: https://github.com/Johnny-Kao/mavlink-js-signing-research/actions/runs/42226080374
Thanks for taking a look!