Use subtle.ConstantTimeCompare instead of compare directly (goharbor#…

…18697) Signed-off-by: stonezdj <[email protected]> Signed-off-by: Wilfred Almeida <[email protected]>
WilfredAlmeida · Jul 8, 2023 · 48b53fe · 48b53fe
1 parent a21b089
commit 48b53fe
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/src/jobservice/api/authenticator.go b/src/jobservice/api/authenticator.go
@@ -15,6 +15,7 @@
 package api
 
 import (
+	"crypto/subtle"
 	"errors"
 	"fmt"
 	"net/http"
@@ -66,7 +67,7 @@ func (sa *SecretAuthenticator) DoAuth(req *http.Request) error {
 	}
 
 	expectedSecret := config.GetUIAuthSecret()
-	if expectedSecret != secret {
+	if subtle.ConstantTimeCompare([]byte(expectedSecret), []byte(secret)) == 0 {
 		return errors.New("unauthorized")
 	}
 

diff --git a/src/registryctl/auth/secret.go b/src/registryctl/auth/secret.go
@@ -15,6 +15,7 @@
 package auth
 
 import (
+	"crypto/subtle"
 	"errors"
 	"net/http"
 	"strings"
@@ -54,7 +55,7 @@ func (s *secretHandler) AuthorizeRequest(req *http.Request) error {
 	secInReq := strings.TrimPrefix(auth, HarborSecret)
 
 	for _, v := range s.secrets {
-		if secInReq == v {
+		if subtle.ConstantTimeCompare([]byte(secInReq), []byte(v)) == 1 {
 			return nil
 		}
 	}