From 11278ff6c275bd82579b02ef4a79d41d1e89e645 Mon Sep 17 00:00:00 2001 From: James Read Date: Tue, 6 Jan 2026 22:09:17 +0000 Subject: [PATCH] fix: Use constant-time comparison for Basic auth verification. Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --- service/internal/webhooks/auth.go | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/service/internal/webhooks/auth.go b/service/internal/webhooks/auth.go index 5e7f26c..31daf80 100644 --- a/service/internal/webhooks/auth.go +++ b/service/internal/webhooks/auth.go @@ -120,10 +120,21 @@ func (v *AuthVerifier) verifyBasic(r *http.Request) bool { return false } +import ( + "crypto/subtle" + // ... existing imports +) + +func (v *AuthVerifier) verifyBasic(r *http.Request) bool { + // ... existing checks ... + parts := strings.SplitN(v.config.Secret, ":", 2) if len(parts) == 2 { - return username == parts[0] && password == parts[1] + usernameMatch := subtle.ConstantTimeCompare([]byte(username), []byte(parts[0])) + passwordMatch := subtle.ConstantTimeCompare([]byte(password), []byte(parts[1])) + return usernameMatch == 1 && passwordMatch == 1 } - return password == v.config.Secret + return subtle.ConstantTimeCompare([]byte(password), []byte(v.config.Secret)) == 1 +} }