mirror of
https://github.com/rclone/rclone.git
synced 2026-09-25 07:16:00 -04:00
Nick Craig-Wood
b7a1184019
The builtin authentication compared the configured username and password with ==, whose run time depends on how much of the value matches, giving a timing side-channel that could in principle help guess the password. serve sftp, serve s3 and the auth proxy already use subtle.ConstantTimeCompare so bring serve ftp in line with them. An empty configured password still accepts any password. Addresses GHSA-mfvx-7rcj-9m5g finding 4.