melosh/mal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use constant-time comparison for proxy token signature

Browse Source
This commit is contained in:
mkelvers
2026-05-26 15:31:37 +02:00
parent a190ca417d
commit f8ba6db3d6
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
internal/playback/service/service.go
View File

@@ -78,11 +78,14 @@ func (s *playbackService) VerifyProxyToken(token string) (proxyTokenPayload, err
if err != nil { if err != nil {
return proxyTokenPayload{}, err return proxyTokenPayload{}, err
} }
decodedSig, err := base64.RawURLEncoding.DecodeString(parts[1])
if err != nil {
return proxyTokenPayload{}, fmt.Errorf("invalid signature encoding: %w", err)
}
mac := hmac.New(sha256.New, []byte(s.proxyTokenKey)) mac := hmac.New(sha256.New, []byte(s.proxyTokenKey))
mac.Write(body) mac.Write(body)
signature := mac.Sum(nil) expectedSig := mac.Sum(nil)
encodedSig := base64.RawURLEncoding.EncodeToString(signature) if !hmac.Equal(expectedSig, decodedSig) {
if encodedSig != parts[1] {
return proxyTokenPayload{}, fmt.Errorf("invalid signature") return proxyTokenPayload{}, fmt.Errorf("invalid signature")
} }
var payload proxyTokenPayload var payload proxyTokenPayload