search

mattermost / mattermost-plugin-msteams

MS Teams plugin for Mattermost
Other
13 stars 11 forks source link

[MM-57072] Use ConstantTimeCompare to prevent timing attack #549

Closed JulienTant closed 5 months ago

JulienTant commented 6 months ago

Summary

Use ConstantTimeCompare instead of != to reduce the risk of timing attacks on the webhook secret

Ticket Link

https://mattermost.atlassian.net/browse/MM-57072

JulienTant commented 6 months ago

@lindy65 I'm not quite sure how to test the security part of this - for the functional side we just want to make sure that messages are synced as before.

JulienTant commented 5 months ago

@lindy65 deferring this to get it in