Upstream/harbor
1
0
Fork 0
mirror of https://github.com/goharbor/harbor.git synced 2024-09-27 04:52:55 +02:00
Code Issues Projects Releases Wiki Activity

Use subtle.ConstantTimeCompare instead of compare directly (#18697)

Browse Source 
Signed-off-by: stonezdj <daojunz@vmware.com>
This commit is contained in:
stonezdj(Daojun Zhang) 2023-05-22 16:16:52 +08:00 committed by GitHub
parent ac70a14397
commit 9d042ad585
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/jobservice/api/authenticator.go
View File

@ -15,6 +15,7 @@
package api
import (
"crypto/subtle"
"errors"
"fmt"
"net/http"
@ -66,7 +67,7 @@ func (sa *SecretAuthenticator) DoAuth(req *http.Request) error {
}
expectedSecret := config.GetUIAuthSecret()
if expectedSecret != secret {
if subtle.ConstantTimeCompare([]byte(expectedSecret), []byte(secret)) == 0 {
return errors.New("unauthorized")
}

3
src/registryctl/auth/secret.go
View File

@ -15,6 +15,7 @@
package auth
import (
"crypto/subtle"
"errors"
"net/http"
"strings"
@ -54,7 +55,7 @@ func (s *secretHandler) AuthorizeRequest(req *http.Request) error {
secInReq := strings.TrimPrefix(auth, HarborSecret)
for _, v := range s.secrets {
if secInReq == v {
if subtle.ConstantTimeCompare([]byte(secInReq), []byte(v)) == 1 {
return nil
}
}