domi/forgejo-domi
1
0
Fork 0
forked from forgejo/forgejo
Code Pull requests Activity

routers: do not leak secrets via timing side channel (#7364)

Browse source 
* routers: do not leak secrets via timing side channel

* routers/repo: do not leak secrets via timing side channel
This commit is contained in:
leonklingele 2019-07-06 19:03:13 +02:00 • committed by techknowlogick
parent 96b66e330b
commit ef57fe4ae3
2 changed files with 9 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
routers/metrics.go
View file

@ -5,6 +5,8 @@
package routers
import (
"crypto/subtle"
"github.com/prometheus/client_golang/prometheus/promhttp"
"code.gitea.io/gitea/modules/context"
@ -22,7 +24,9 @@ func Metrics(ctx *context.Context) {
ctx.Error(401)
return
}
if header != "Bearer "+setting.Metrics.Token {
got := []byte(header)
want := []byte("Bearer " + setting.Metrics.Token)
if subtle.ConstantTimeCompare(got, want) != 1 {
ctx.Error(401)
return
}