Use hash_equals in the access check

Created on 5 May 2023, over 1 year ago
Updated 31 May 2023, over 1 year ago

Problem/Motivation

The access check happening in checkActivationAndSiteGuardianKey() is potentially susceptible to timing attacks. The key comparison should be done using hash_equals() to mitigate.

Steps to reproduce

Install the module
Spam the endpoints

Proposed resolution

Amend the hash check to use hash_equals to avoid timing attacks

Remaining tasks

Amend the hash check to use hash_equals to avoid timing attacks

User interface changes

None

API changes

None

Data model changes

None

πŸ› Bug report
Status

Fixed

Version

1.0

Component

Code

Created by

πŸ‡¬πŸ‡§United Kingdom the_g_bomb

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.71.5 2024