oss/miniflux-v2
oss/miniflux-v2
1
0
Fork 0
mirror of https://github.com/miniflux/v2.git synced 2025-09-15 18:57:04 +00:00
Code Wiki Activity

Use constant-time comparison for anti-csrf tokens

Browse source 
This is probably completely overkill, but since anti-csrf tokens are secrets,
they should be compared against untrusted inputs in constant time.
This commit is contained in:
jvoisin 2024-03-04 00:08:55 +01:00 • committed by Frédéric Guillot
parent 9fe99ce7fa
commit d55b410800
2 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
internal/crypto/crypto.go
View file

@ -7,6 +7,7 @@ import (
"crypto/hmac"
"crypto/rand"
"crypto/sha256"
"crypto/subtle"
"encoding/base64"
"encoding/hex"
"fmt"
@ -60,3 +61,7 @@ func GenerateUUID() string {
b := GenerateRandomBytes(16)
return fmt.Sprintf("%X-%X-%X-%X-%X", b[0:4], b[4:6], b[6:8], b[8:10], b[10:])
}
func ConstantTimeCmp(a, b string) bool {
return subtle.ConstantTimeCompare([]byte(a), []byte(b)) == 1
}