tdsds.com/gitea
1
1
Fork 0
mirror of https://github.com/go-gitea/gitea synced 2025-07-22 18:28:37 +00:00
Code Releases Activity

routers: do not leak secrets via timing side channel (#7364)

Browse Source 
* routers: do not leak secrets via timing side channel

* routers/repo: do not leak secrets via timing side channel
This commit is contained in:
leonklingele
2019-07-06 19:03:13 +02:00
committed by techknowlogick
parent 96b66e330b
commit ef57fe4ae3
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
routers/repo/pull.go
View File

@@ -8,6 +8,7 @@ package repo
import (
"container/list"
"crypto/subtle"
"fmt"
"io"
"path"
@@ -771,7 +772,9 @@ func TriggerTask(ctx *context.Context) {
if ctx.Written() {
return
}
if secret != base.EncodeMD5(owner.Salt) {
got := []byte(base.EncodeMD5(owner.Salt))
want := []byte(secret)
if subtle.ConstantTimeCompare(got, want) != 1 {
ctx.Error(404)
log.Trace("TriggerTask [%s/%s]: invalid secret", owner.Name, repo.Name)
return