knadh/listmonk
1
1
Fork 0
mirror of https://github.com/knadh/listmonk.git synced 2025-10-12 00:06:57 +08:00
Code Issues Projects Releases Packages Wiki Activity

Fixed ineffective constant-time-conparison protection

Browse source
This commit is contained in:
Rohith Kumar Ankam 2025-09-23 20:56:58 +05:30
parent 65eeaca312
commit 836a017f9d
1 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
cmd/auth.go
View file

@ -323,9 +323,17 @@ func (a *App) createOIDCUser(claims auth.OIDCclaim, c echo.Context) (auth.User,
// doLogin logs a user in with a username and password. // doLogin logs a user in with a username and password.
func (a *App) doLogin(c echo.Context) error { func (a *App) doLogin(c echo.Context) error {
var ( var (
startTime = time.Now()
username = strings.TrimSpace(c.FormValue("username")) username = strings.TrimSpace(c.FormValue("username"))
password = strings.TrimSpace(c.FormValue("password")) password = strings.TrimSpace(c.FormValue("password"))
) )
// Ensure timing mitigation is applied regardless of early returns
defer func() {
if elapsed := time.Since(startTime).Milliseconds(); elapsed < 100 {
time.Sleep(time.Duration(100-elapsed) * time.Millisecond)
}
}()
if !strHasLen(username, 3, stdInputMaxLen) { if !strHasLen(username, 3, stdInputMaxLen) {
return echo.NewHTTPError(http.StatusBadRequest, a.i18n.Ts("globals.messages.invalidFields", "name", "username")) return echo.NewHTTPError(http.StatusBadRequest, a.i18n.Ts("globals.messages.invalidFields", "name", "username"))
@ -340,11 +348,6 @@ func (a *App) doLogin(c echo.Context) error {
return err return err
} }
// Resist potential constant-time-comparison attacks with a min response time.
if ms := time.Since(time.Now()).Milliseconds(); ms < 100 {
time.Sleep(time.Duration(ms))
}
// Set the session in the DB and cookie. // Set the session in the DB and cookie.
if err := a.auth.SaveSession(user, "", c); err != nil { if err := a.auth.SaveSession(user, "", c); err != nil {
return err return err