os-autoinst / openQA

openQA web-frontend, scheduler and tools.
http://openqa.opensuse.org/
GNU General Public License v2.0
319 stars 209 forks source link

Add proper constant time comparison authentication functions #5775

Closed nicksinger closed 3 months ago

nicksinger commented 3 months ago

This prevents timing attacks on our API endpoints and orders existing use of that function with the secret as last argument as described by the documentation of Mojo::Util ("The secret string should be the second argument, to avoid leaking information about the length of the string.").

codecov[bot] commented 3 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 98.49%. Comparing base (1979f49) to head (238b0fc). Report is 3 commits behind head on master.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## master #5775 +/- ## ======================================= Coverage 98.49% 98.49% ======================================= Files 394 394 Lines 38657 38657 ======================================= Hits 38074 38074 Misses 583 583 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.