engineering/sshpiper
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactor code to use subtle.ConstantTimeCompare for secure comparison (#466)

Browse source 
* Refactor code to use subtle.ConstantTimeCompare for secure comparison

* Refactor code to use subtle.ConstantTimeCompare for secure comparison
This commit is contained in:
Boshi Lian 2024-10-21 02:46:19 -07:00 • committed by GitHub
parent 3087aa4eb6
commit a3f69952c0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 8 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

3
plugin/yaml/yaml.go
View file

@ -4,6 +4,7 @@ package main
import (
"bytes"
"crypto/subtle"
"encoding/base64"
"fmt"
"os"
@ -329,7 +330,7 @@ func (p *plugin) findAndCreateUpstream(conn libplugin.ConnMetadata, password str
return nil, err
}
if bytes.Equal(authedPubkey.Marshal(), publicKey) {
if subtle.ConstantTimeCompare(authedPubkey.Marshal(), publicKey) == 1 {
return p.createUpstream(conn, pipe.To, "")
}
}