Security fixes for decryption paths + VCR cassette compatibility

.pubnub.yml

@@ -1,5 +1,5 @@
 name: python
-version: 10.7.1
+version: 10.7.2
 schema: 1
 scm: github.com/pubnub/python
 sdks:
@@ -18,7 +18,7 @@ sdks:
         distributions:
           - distribution-type: library
             distribution-repository: package
-            package-name: pubnub-10.7.1
+            package-name: pubnub-10.7.2
             location: https://pypi.org/project/pubnub/
             supported-platforms:
               supported-operating-systems:
@@ -94,8 +94,8 @@ sdks:
           -
             distribution-type: library
             distribution-repository: git release
-            package-name: pubnub-10.7.1
-            location: https://github.com/pubnub/python/releases/download/10.7.1/pubnub-10.7.1.tar.gz
+            package-name: pubnub-10.7.2
+            location: https://github.com/pubnub/python/releases/download/10.7.2/pubnub-10.7.2.tar.gz
             supported-platforms:
               supported-operating-systems:
                 Linux:
@@ -169,6 +169,15 @@ sdks:
                 license-url: https://github.com/encode/httpx/blob/master/LICENSE.md
                 is-required: Required
 changelog:
+  - date: 2026-07-08
+    version: 10.7.2
+    changes:
+      - type: bug
+        text: "`PubNubFileCrypto.decrypt` now raises `PubNubException('decryption error')` instead of returning the still-encrypted bytes on failure, so callers can no longer mistake ciphertext for plaintext."
+      - type: bug
+        text: "Cryptors now return a single generic error on any decryption failure instead of surfacing the underlying crypto-library message. Cause kept in debug logs only."
+      - type: improvement
+        text: "Strip dead python-object URL tags from asyncio VCR cassettes so vcrpy's hardened SafeLoader can deserialize them."
   - date: 2026-06-15
     version: 10.7.1
     changes:

CHANGELOG.md

@@ -1,3 +1,13 @@
+## 10.7.2
+July 08 2026
+
+#### Fixed
+- `PubNubFileCrypto.decrypt` now raises `PubNubException('decryption error')` instead of returning the still-encrypted bytes on failure, so callers can no longer mistake ciphertext for plaintext.
+- Cryptors now return a single generic error on any decryption failure instead of surfacing the underlying crypto-library message. Cause kept in debug logs only.
+
+#### Modified
+- Strip dead python-object URL tags from asyncio VCR cassettes so vcrpy's hardened SafeLoader can deserialize them.
+
 ## 10.7.1
 June 15 2026
 

pubnub/crypto.py

@@ -44,10 +44,15 @@ def decrypt(self, key, msg, use_random_iv=False):
             plain = self.depad((cipher.decrypt(extracted_message)).decode('utf-8'))
         except UnicodeDecodeError as e:
             if not self.fallback_mode:
-                raise e
+                logging.debug(f'Decryption failed: {e}')
+                raise PubNubException('decryption error')
 
-            cipher = AES.new(bytes(secret[0:32], "utf-8"), self.fallback_mode, initialization_vector)
-            plain = self.depad((cipher.decrypt(extracted_message)).decode('utf-8'))
+            try:
+                cipher = AES.new(bytes(secret[0:32], "utf-8"), self.fallback_mode, initialization_vector)
+                plain = self.depad((cipher.decrypt(extracted_message)).decode('utf-8'))
+            except (UnicodeDecodeError, ValueError, IndexError) as fallback_error:
+                logging.debug(f'Decryption failed: {fallback_error}')
+                raise PubNubException('decryption error')
 
         try:
             return json.loads(plain)
@@ -103,11 +108,16 @@ def decrypt(self, key, file, use_random_iv=True):
         try:
             cipher = AES.new(bytes(secret[0:32], "utf-8"), self.mode, initialization_vector)
             result = unpad(cipher.decrypt(extracted_file), 16)
-        except ValueError:
-            if not self.fallback_mode:  # No fallback mode so we return the original content
-                return file
-            cipher = AES.new(bytes(secret[0:32], "utf-8"), self.fallback_mode, initialization_vector)
-            result = unpad(cipher.decrypt(extracted_file), 16)
+        except ValueError as e:
+            if not self.fallback_mode:
+                logging.debug(f'File decryption failed: {e}')
+                raise PubNubException('decryption error')
+            try:
+                cipher = AES.new(bytes(secret[0:32], "utf-8"), self.fallback_mode, initialization_vector)
+                result = unpad(cipher.decrypt(extracted_file), 16)
+            except ValueError as fallback_error:
+                logging.debug(f'File decryption failed: {fallback_error}')
+                raise PubNubException('decryption error')
 
         return result
 

pubnub/crypto_core.py

@@ -1,5 +1,6 @@
 import hashlib
 import json
+import logging
 import secrets
 
 from abc import abstractmethod
@@ -79,15 +80,24 @@ def decrypt(self, payload: CryptorPayload, key=None, use_random_iv=False, binary
             raise PubNubException('decryption error')
         cipher = AES.new(bytes(secret[0:32], "utf-8"), self.mode, initialization_vector)
         if binary_mode:
-            return self.depad(cipher.decrypt(extracted_message), binary_mode)
+            try:
+                return self.depad(cipher.decrypt(extracted_message), binary_mode)
+            except (ValueError, IndexError) as e:
+                logging.debug(f'Decryption failed: {e}')
+                raise PubNubException('decryption error')
         try:
             plain = self.depad((cipher.decrypt(extracted_message)).decode('utf-8'), binary_mode)
         except UnicodeDecodeError as e:
             if not self.fallback_mode:
-                raise e
+                logging.debug(f'Decryption failed: {e}')
+                raise PubNubException('decryption error')
 
-            cipher = AES.new(bytes(secret[0:32], "utf-8"), self.fallback_mode, initialization_vector)
-            plain = self.depad((cipher.decrypt(extracted_message)).decode('utf-8'), binary_mode)
+            try:
+                cipher = AES.new(bytes(secret[0:32], "utf-8"), self.fallback_mode, initialization_vector)
+                plain = self.depad((cipher.decrypt(extracted_message)).decode('utf-8'), binary_mode)
+            except (UnicodeDecodeError, ValueError, IndexError) as fallback_error:
+                logging.debug(f'Decryption failed: {fallback_error}')
+                raise PubNubException('decryption error')
 
         try:
             return json.loads(plain)
@@ -156,7 +166,11 @@ def decrypt(self, payload: CryptorPayload, key=None, binary_mode: bool = False,
 
         cipher = AES.new(secret, mode=self.mode, iv=iv)
 
-        if binary_mode:
-            return unpad(cipher.decrypt(payload['data']), AES.block_size)
-        else:
-            return unpad(cipher.decrypt(payload['data']), AES.block_size).decode()
+        try:
+            if binary_mode:
+                return unpad(cipher.decrypt(payload['data']), AES.block_size)
+            else:
+                return unpad(cipher.decrypt(payload['data']), AES.block_size).decode()
+        except (ValueError, UnicodeDecodeError) as e:
+            logging.debug(f'Decryption failed: {e}')
+            raise PubNubException('decryption error')

pubnub/workers.py

@@ -47,7 +47,8 @@ def _process_message(self, message_input):
             try:
                 return self._pubnub.crypto.decrypt(message_input), None
             except Exception as exception:
-                logger.warning("could not decrypt message: \"%s\", due to error %s" % (message_input, str(exception)))
+                logger.warning("could not decrypt message, due to error %s" % str(exception))
+                logger.debug("could not decrypt message: \"%s\", due to error %s" % (message_input, str(exception)))
 
                 pn_status = PNStatus()
                 pn_status.category = PNStatusCategory.PNDecryptionErrorCategory

setup.py

@@ -2,7 +2,7 @@
 
 setup(
     name='pubnub',
-    version='10.7.1',
+    version='10.7.2',
     description='PubNub Real-time push service in the cloud',
     author='PubNub',
     author_email='support@pubnub.com',

tests/integrational/fixtures/asyncio/history/delete_success.yaml

@@ -23,12 +23,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - https
-        - ps.pndsn.com
-        - /v3/history/sub-key/sub-c-mock-key/channel/my-ch
-        - start=123&end=456&pnsdk=PubNub-Python-Asyncio%2F4.7.0&uuid=af9429d0-aa10-4919-9670-abe67a5c395f
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/history/delete_with_space_and_wildcard_in_channel_name.yaml

@@ -23,12 +23,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - https
-        - ps.pndsn.com
-        - /v3/history/sub-key/sub-c-mock-key/channel/my-ch-%20%7C.%2A%20%24
-        - start=123&end=456&pnsdk=PubNub-Python-Asyncio%2F4.7.0&uuid=fbbfbfbf-2b08-4561-bccb-3a0003b0b71b
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/members/get_members.yaml

@@ -20,12 +20,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - http
-        - ps.pndsn.com
-        - /v1/objects/demo/spaces/value1/users
-        - count=True&include=custom,user,user.custom&pnsdk=PubNub-Python-Asyncio%2F4.1.0&uuid=f032239c-241a-45f7-ac74-02ebfe06a29e
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/members/get_space_memberships.yaml

@@ -20,12 +20,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - http
-        - ps.pndsn.com
-        - /v1/objects/demo/users/mg3/spaces
-        - count=True&include=custom,space,space.custom&pnsdk=PubNub-Python-Asyncio%2F4.1.0&uuid=8d72a1a1-eec4-4b3f-84d6-53e88c80ded1
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/members/update_members.yaml

@@ -21,12 +21,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - http
-        - ps.pndsn.com
-        - /v1/objects/demo/spaces/value1/users
-        - include=custom,user,user.custom&pnsdk=PubNub-Python-Asyncio%2F4.1.0&uuid=8cc8fb7d-6bb8-4109-a6b9-750490d89e7a
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/members/update_space_memberships.yaml

@@ -20,12 +20,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - http
-        - ps.pndsn.com
-        - /v1/objects/demo/users/mg/spaces
-        - include=custom,space,space.custom&pnsdk=PubNub-Python-Asyncio%2F4.1.0&uuid=ca41ef07-c7db-4874-be1d-7039c919ef6f
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/message_count/multi.yaml

@@ -11,11 +11,6 @@ interactions:
       Cache-Control: no-cache, Connection: keep-alive, Content-Length: '30', Content-Type: text/javascript;
         charset="UTF-8", Date: 'Sun, 24 Feb 2019 20:13:16 GMT'}
     status: {code: 200, message: OK}
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult [http, balancer1g.bronze.aws-pdx-1.ps.pn,
-        /publish/demo-36/demo-36/0/unique_asyncio_1/0/%22something%22, pnsdk=PubNub-Python-Asyncio%2F4.1.0&uuid=d2a546ca-037c-499a-9d87-35951bbbd289,
-        '']
 - request:
     body: null
     headers:
@@ -30,10 +25,4 @@ interactions:
       Content-Length: '109', Content-Type: text/javascript; charset="UTF-8", Date: 'Sun,
         24 Feb 2019 20:13:16 GMT', Server: Pubnub}
     status: {code: 200, message: OK}
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult [http, balancer1g.bronze.aws-pdx-1.ps.pn,
-        '/v3/history/sub-key/demo-36/message-counts/unique_asyncio_1,unique_asyncio_2',
-        'channelsTimetoken=15510391962937046,15510391962937046&pnsdk=PubNub-Python-Asyncio%2F4.1.0&uuid=d2a546ca-037c-499a-9d87-35951bbbd289&l_pub=0.37061548233032227',
-        '']
 version: 1

tests/integrational/fixtures/asyncio/message_count/single.yaml

@@ -11,11 +11,6 @@ interactions:
       Cache-Control: no-cache, Connection: keep-alive, Content-Length: '30', Content-Type: text/javascript;
         charset="UTF-8", Date: 'Sun, 24 Feb 2019 20:13:15 GMT'}
     status: {code: 200, message: OK}
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult [http, balancer1g.bronze.aws-pdx-1.ps.pn,
-        /publish/demo-36/demo-36/0/unique_asyncio/0/%22bla%22, pnsdk=PubNub-Python-Asyncio%2F4.1.0&uuid=68f7b4f4-c169-4a49-b09d-7c68e22049b8,
-        '']
 - request:
     body: null
     headers:
@@ -30,9 +25,4 @@ interactions:
       Content-Length: '86', Content-Type: text/javascript; charset="UTF-8", Date: 'Sun,
         24 Feb 2019 20:13:15 GMT', Server: Pubnub}
     status: {code: 200, message: OK}
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult [http, balancer1g.bronze.aws-pdx-1.ps.pn,
-        /v3/history/sub-key/demo-36/message-counts/unique_asyncio, timetoken=15510391957007172&pnsdk=PubNub-Python-Asyncio%2F4.1.0&uuid=68f7b4f4-c169-4a49-b09d-7c68e22049b8&l_pub=0.4618048667907715,
-        '']
 version: 1

tests/integrational/fixtures/asyncio/pam/global_level.yaml

@@ -22,14 +22,6 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - https
-        - ps.pndsn.com
-        - /v2/auth/grant/sub-key/sub-c-7ba2ac4c-4836-11e6-85a4-0619f8945a4f
-        - pnsdk=PubNub-Python-Asyncio%2F4.7.0&r=1&signature=v2.Um4OSe_f8tRtFo2tuw0lmwE6Rq5wgjTHmfblkIyoZ4I&timestamp=1606303468&uuid=my_uuid&w=1
-        - ''
 - request:
     body: null
     headers:
@@ -53,12 +45,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - https
-        - ps.pndsn.com
-        - /v2/auth/grant/sub-key/sub-c-7ba2ac4c-4836-11e6-85a4-0619f8945a4f
-        - g=0&j=0&l_pam=0.24709081649780273&m=0&pnsdk=PubNub-Python-Asyncio%2F4.7.0&r=0&signature=v2.NyyRFAQKOOpqAAAMlcN6wHg-cmHLwC6L7KgdEqwS7bY&timestamp=1606303468&u=0&uuid=my_uuid&w=0
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/pam/multiple_channel_groups.yaml

@@ -22,12 +22,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - http
-        - ps.pndsn.com
-        - /v2/auth/grant/sub-key/sub-c-7ba2ac4c-4836-11e6-85a4-0619f8945a4f
-        - channel-group=test-pam-asyncio-cg1,test-pam-asyncio-cg2&pnsdk=PubNub-Python-Asyncio%2F4.1.0&r=1&signature=v2.0eTFy_Kgi-Qiz6nD3NmfZlu4Z4ndtUT5pYHl57imcZI&timestamp=1577189139&uuid=my_uuid&w=1
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/pam/multiple_channel_groups_with_auth.yaml

@@ -22,12 +22,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - http
-        - ps.pndsn.com
-        - /v2/auth/grant/sub-key/sub-c-7ba2ac4c-4836-11e6-85a4-0619f8945a4f
-        - auth=test-pam-asyncio-auth&channel-group=test-pam-asyncio-cg1,test-pam-asyncio-cg2&pnsdk=PubNub-Python-Asyncio%2F4.1.0&r=1&signature=v2.pjnKPVphocAsl8BsxLeirCZMbNVzNOQV3CS6mfm1Bbc&timestamp=1577189139&uuid=my_uuid&w=1
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/pam/multiple_channels.yaml

@@ -22,12 +22,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - http
-        - ps.pndsn.com
-        - /v2/auth/grant/sub-key/sub-c-7ba2ac4c-4836-11e6-85a4-0619f8945a4f
-        - channel=test-pam-asyncio-ch1,test-pam-asyncio-ch2&pnsdk=PubNub-Python-Asyncio%2F4.1.0&r=1&signature=v2.z01_vYcxRHcQlLohU41PTYPzZOfaU8xWK4qXRF4bjK8&timestamp=1577189138&uuid=test-pam-asyncio-uuid&w=1
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/pam/multiple_channels_with_auth.yaml

@@ -22,12 +22,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - http
-        - ps.pndsn.com
-        - /v2/auth/grant/sub-key/sub-c-7ba2ac4c-4836-11e6-85a4-0619f8945a4f
-        - auth=test-pam-asyncio-auth&channel=test-pam-asyncio-ch1,test-pam-asyncio-ch2&pnsdk=PubNub-Python-Asyncio%2F4.1.0&r=1&signature=v2.YX_q8cliqGK-cMPUevjVQ1rRnEFAkKLLkutGJt9X1OY&timestamp=1577189138&uuid=my_uuid&w=1
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/pam/single_channel.yaml

@@ -22,12 +22,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - http
-        - ps.pndsn.com
-        - /v2/auth/grant/sub-key/sub-c-7ba2ac4c-4836-11e6-85a4-0619f8945a4f
-        - channel=test-pam-asyncio-ch&pnsdk=PubNub-Python-Asyncio%2F4.1.0&r=1&signature=v2.fNqcroTl6ykcSUYDgrOmpGVe2b_11FKkOjU8_LMt7E8&timestamp=1577189138&uuid=my_uuid&w=1
-        - ''
 version: 1

tests/integrational/fixtures/asyncio/pam/single_channel_group.yaml

@@ -22,12 +22,4 @@ interactions:
     status:
       code: 200
       message: OK
-    url: !!python/object/new:yarl.URL
-      state: !!python/tuple
-      - !!python/object/new:urllib.parse.SplitResult
-        - http
-        - ps.pndsn.com
-        - /v2/auth/grant/sub-key/sub-c-7ba2ac4c-4836-11e6-85a4-0619f8945a4f
-        - channel-group=test-pam-asyncio-cg&pnsdk=PubNub-Python-Asyncio%2F4.1.0&r=1&signature=v2.BihlEpGJOoGHtVcTzIw1h0Jp7vqKoIdpkxaIYrvV1FU&timestamp=1577189138&uuid=test-pam-asyncio-uuid&w=1
-        - ''
 version: 1