Ensure guid is hexadecimal value

lib/galaxy/security/idencoding.py

@@ -1,7 +1,10 @@
 import codecs
 import collections
 import logging
-from typing import Optional
+from typing import (
+    Optional,
+    Union,
+)
 
 from Crypto.Cipher import Blowfish
 from Crypto.Random import get_random_bytes
@@ -102,15 +105,18 @@ class IdEncodingHelper:
         # Encrypt
         return codecs.encode(self.id_cipher.encrypt(s), "hex")
 
-    def decode_guid(self, session_key):
+    def decode_guid(self, session_key: Union[bytes, str]) -> str:
         # Session keys are strings
         try:
             decoded_session_key = codecs.decode(session_key, "hex")
-            return unicodify(self.id_cipher.decrypt(decoded_session_key)).lstrip("!")
+            stripped_decoded_session_key = unicodify(self.id_cipher.decrypt(decoded_session_key)).lstrip("!")
+            # Ensure session key is hexadecimal value
+            int(stripped_decoded_session_key, 16)
+            return stripped_decoded_session_key
         except TypeError:
-            raise galaxy.exceptions.MalformedId(f"Malformed guid '{session_key}' specified, unable to decode.")
+            raise galaxy.exceptions.MalformedId(f"Malformed guid '{session_key!r}' specified, unable to decode.")
         except ValueError:
-            raise galaxy.exceptions.MalformedId(f"Wrong guid '{session_key}' specified, unable to decode.")
+            raise galaxy.exceptions.MalformedId(f"Wrong guid '{session_key!r}' specified, unable to decode.")
 
     def get_new_guid(self):
         # Generate a unique, high entropy 128 bit random number

test/unit/data/security/test_id_encode_decode.py

@@ -62,6 +62,17 @@ def test_maximum_length_handling_nonascii():
     assert e11 != e12
 
 
+def test_unicode_null_decoding():
+    encoded_id = test_helper_1.encode_id(1)
+    threw_exception = False
+    try:
+        test_helper_1.decode_guid(f"{encoded_id[:-1]}\0")
+    except Exception:
+        threw_exception = True
+
+    assert threw_exception
+
+
 def test_encode_decode():
     # Different ids are encoded differently
     assert test_helper_1.encode_id(1) != test_helper_1.encode_id(2)