raise exceptions.UnknownError if body is not a dict

Author: yvonnep165

firebase_admin/app_check.py

@@ -19,7 +19,7 @@
 import jwt
 from jwt import PyJWKClient, ExpiredSignatureError, InvalidTokenError, DecodeError
 from jwt import InvalidAudienceError, InvalidIssuerError, InvalidSignatureError
-from firebase_admin import _http_client, _utils
+from firebase_admin import _http_client, _utils, exceptions
 
 _APP_CHECK_ATTRIBUTE = '_app_check'
 
@@ -108,9 +108,13 @@ def verify_token(self, token: str, consume: bool = False) -> Dict[str, Any]:
             except requests.exceptions.RequestException as error:
                 raise _utils.handle_platform_error_from_requests(error)
 
-            already_consumed = False
-            if isinstance(body, dict):
-                already_consumed = body.get('alreadyConsumed', False)
+            if not isinstance(body, dict):
+                raise exceptions.UnknownError(
+                    'Unexpected response from App Check service. '
+                    f'Expected a JSON object, but got {type(body).__name__}.'
+                )
+
+            already_consumed = body.get('alreadyConsumed', False)
             verified_claims['already_consumed'] = bool(already_consumed)
 
         return verified_claims

tests/test_app_check.py

@@ -339,3 +339,18 @@ def test_verify_token_with_consume_true_backend_error(self, mocker):
 
         with pytest.raises(exceptions.FirebaseError):
             app_check.verify_token("encoded", app=app, consume=True)
+
+    @pytest.mark.parametrize('malformed_body', ['string_response', [1, 2], 123, None])
+    def test_verify_token_with_consume_true_malformed_response_raises_error(
+        self, mocker, malformed_body
+    ):
+        mocker.patch("jwt.decode", return_value=JWT_PAYLOAD_SAMPLE)
+        mocker.patch("jwt.PyJWKClient.get_signing_key_from_jwt", return_value=PyJWK(signing_key))
+        mocker.patch("jwt.get_unverified_header", return_value=JWT_PAYLOAD_SAMPLE.get("headers"))
+        app = firebase_admin.get_app()
+        app_check_service = app_check._get_app_check_service(app)
+        mocker.patch.object(app_check_service._http_client, "body", return_value=malformed_body)
+
+        with pytest.raises(exceptions.UnknownError) as excinfo:
+            app_check.verify_token("encoded", app=app, consume=True)
+        assert 'Unexpected response from App Check service' in str(excinfo.value)