Language: Python
Label: safe
CWE: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Code:
def validate_hmac_signature(
    notification: Dict[str, Any], gateway_config: "GatewayConfig"
) -> bool:

    """
    pspReference	7914073381342284
    originalReference
    merchantAccountCode	YOUR_MERCHANT_ACCOUNT
    merchantReference	TestPayment-1407325143704
    value	1130
    currency	EUR
    eventCode	AUTHORISATION
    success	true
    """
    hmac_key = gateway_config.connection_params.get("webhook_hmac")
    if not hmac_key:
        return True

    hmac_signature = notification.get("additionalData", {}).get("hmacSignature")
    if not hmac_signature and hmac_key:
        return False

    success = "true" if notification.get("success", "") else "false"
    if notification.get("success", None) is None:
        success = ""

    payload_list = [
        notification.get("pspReference", ""),
        notification.get("originalReference", ""),
        notification.get("merchantAccountCode", ""),
        notification.get("merchantReference", ""),
        notification.get("value", ""),
        notification.get("currency", ""),
        notification.get("eventCode", ""),
        success,
    ]
    payload = ":".join(payload_list)

    hm = hmac.new(hmac_key, payload.encode("utf-8"), hashlib.sha256)
    expected_merchant_sign = base64.b64encode(hm.digest())
    return hmac_signature == expected_merchant_sign.decode("utf-8")