From 85d69e8711f8686b54615535eba380fc34d73d08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 19 Oct 2026 12:37:54 -0700
Subject: [PATCH 1/2] gh-155426: correctly reject non-bytes keys in
 `hmac.digest` (GH-155427)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This only affects keys of length smaller than the HMAC blocksize
since larger keys are hashed first.
(cherry picked from commit 197d33218f755af0758c83add3956e0bd7ef8657)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
---
 Lib/hmac.py                                                 | 3 +++
 Lib/test/test_hmac.py                                       | 6 ++++++
 .../Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst  | 4 ++++
 3 files changed, 13 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst

diff --git a/Lib/hmac.py b/Lib/hmac.py
index e0c040bcd5fe3d2..61e0823e68be215 100644
--- a/Lib/hmac.py
+++ b/Lib/hmac.py
@@ -267,6 +267,9 @@ def digest(key, msg, digest):
 
 
 def _compute_digest_fallback(key, msg, digest):
+    if not isinstance(key, (bytes, bytearray)):
+        raise TypeError(f"key: expected bytes or bytearray, "
+                        f"but got {type(key).__name__!r}")
     digest_cons = _get_digest_constructor(digest)
     if _is_shake_constructor(digest_cons):
         raise ValueError(f"unsupported hash algorithm {digest}")
diff --git a/Lib/test/test_hmac.py b/Lib/test/test_hmac.py
index c43188cc333e88b..e44113edf3f4223 100644
--- a/Lib/test/test_hmac.py
+++ b/Lib/test/test_hmac.py
@@ -1525,6 +1525,12 @@ def test_with_fallback(self):
         finally:
             cache.pop('foo')
 
+    @hashlib_helper.requires_hashdigest("md5")
+    def test_hmac_digest_reject_memoryview_for_key(self):
+        hmac = import_fresh_module("hmac", blocked=["_hashlib", "_hmac"])
+        with self.assertRaises(TypeError):
+            hmac.digest(memoryview(b"small"), b"world", "md5")
+
     @hashlib_helper.requires_openssl_hashdigest("md5")
     @bigmemtest(size=_4G + 5, memuse=2, dry_run=False)
     def test_hmac_digest_overflow_error_openssl_only(self, size):
diff --git a/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
new file mode 100644
index 000000000000000..f1839defbe56742
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
@@ -0,0 +1,4 @@
+Make sure that the pure Python fallback of :func:`hmac.digest` reject
+keys that are neither :class:`bytes` or :class:`bytearray`. Previously,
+an :exc:`AttributeError` was raised instead of :exc:`TypeError`.
+Patch by Bénédikt Tran.

From f1ae2c2b50701469dc53e2d01c4d36e745c88bb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 19 Oct 2026 12:39:13 -0700
Subject: [PATCH 2/2] Update
 Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst

---
 .../next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
index f1839defbe56742..b7424a76ce26ea8 100644
--- a/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
+++ b/Misc/NEWS.d/next/Library/2026-08-09-14-06-27.gh-issue-155426.zZVPMd.rst
@@ -1,4 +1,4 @@
-Make sure that the pure Python fallback of :func:`hmac.digest` reject
+Make sure that the pure Python fallback of :func:`hmac.digest` rejects
 keys that are neither :class:`bytes` or :class:`bytearray`. Previously,
 an :exc:`AttributeError` was raised instead of :exc:`TypeError`.
 Patch by Bénédikt Tran.