mirror/opencloud
1
0 Fork 0
mirror of https://github.com/opencloud-eu/opencloud.git synced 2026-10-07 11:21:56 -04:00
Code Issues Packages Projects Releases Wiki Activity

Use subtle to compare the hash

Browse Source
This commit is contained in:
André Duffeck committed 2026-10-06 09:52:02 +02:00
1 parent 934232e838
commit 7f7da7f583
1 file changed
+3 -1
Download Patch File Download Diff File Expand all files Collapse all files
services/auth-guest/pkg/service/token/token.go
+3 -1
View File
@@ -6,6 +6,7 @@ package token
import (
"crypto/rand"
"crypto/sha256"
"crypto/subtle"
"encoding/base64"
"errors"
"fmt"
@@ -65,7 +66,8 @@ func (s *TokenService) Parse(encoded string) (*Token, error) {
}
func (s *TokenService) Verify(candidate Token, storedSecretHash string) error {
if candidate.ShareIDHash == "" || candidate.secret == "" || candidate.SecretHash() != storedSecretHash {
if candidate.ShareIDHash == "" || candidate.secret == "" ||
subtle.ConstantTimeCompare([]byte(candidate.SecretHash()), []byte(storedSecretHash)) != 1 {
return ErrInvalidToken
}