github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-08-08 13:58:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Use constant-time comparison for shared key authentication (#11122)

Browse Source 
Replace standard '=' operator with MessageDigest/isEqual to prevent
timing attacks on shared key authentication middleware.

Closes #11121

AI-assisted-by: qwen3.7-plus
This commit is contained in:
Andrey Antukh 2026-08-07 11:25:15 +02:00 committed by GitHub
parent 399b00b86d
commit 6951876c13
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
backend/src/app/http/middleware.clj
View File

@ -24,7 +24,8 @@
(:import
io.undertow.server.RequestTooBigException
java.io.InputStream
java.io.OutputStream))
java.io.OutputStream
java.security.MessageDigest))
(set! *warn-on-reflection* true)
@ -329,6 +330,11 @@
{:name ::auth
:compile (constantly wrap-auth)})
(defn- constant-time-eq?
"Compare strings in constant time to prevent timing attacks."
[^String a ^String b]
(MessageDigest/isEqual (.getBytes a "UTF-8") (.getBytes b "UTF-8")))
(defn- wrap-shared-key-auth
[handler keys]
(if (seq keys)
@ -338,7 +344,7 @@
(let [key-id (-> key-id str/lower keyword)]
(if (and (string? key)
(contains? keys key-id)
(= key (get keys key-id)))
(constant-time-eq? key (get keys key-id)))
(-> request
(assoc ::http/auth-key-id key-id)
(handler))