From 27fadafead0e95b8b71d73badbd4ea95b94ce1c8 Mon Sep 17 00:00:00 2001 From: Mattermost Build Date: Mon, 1 Sep 2025 16:34:06 +0300 Subject: [PATCH] Constant time comparison (#33588) (#33822) Automatic Merge --- server/channels/app/oauth.go | 3 ++- server/channels/app/session.go | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/server/channels/app/oauth.go b/server/channels/app/oauth.go index 0975067091..76f4ef69c2 100644 --- a/server/channels/app/oauth.go +++ b/server/channels/app/oauth.go @@ -6,6 +6,7 @@ package app import ( "bytes" "context" + "crypto/subtle" b64 "encoding/base64" "encoding/json" "fmt" @@ -279,7 +280,7 @@ func (a *App) GetOAuthAccessTokenForCodeFlow(c request.CTX, clientId, grantType, return nil, model.NewAppError("GetOAuthAccessToken", "api.oauth.get_access_token.credentials.app_error", nil, "", http.StatusNotFound).Wrap(nErr) } - if oauthApp.ClientSecret != secret { + if subtle.ConstantTimeCompare([]byte(oauthApp.ClientSecret), []byte(secret)) == 0 { return nil, model.NewAppError("GetOAuthAccessToken", "api.oauth.get_access_token.credentials.app_error", nil, "", http.StatusForbidden) } diff --git a/server/channels/app/session.go b/server/channels/app/session.go index fd85973e77..112e0117d6 100644 --- a/server/channels/app/session.go +++ b/server/channels/app/session.go @@ -53,7 +53,7 @@ func (a *App) CreateSession(c request.CTX, session *model.Session) (*model.Sessi func (a *App) GetCloudSession(token string) (*model.Session, *model.AppError) { apiKey := os.Getenv("MM_CLOUD_API_KEY") - if apiKey != "" && apiKey == token { + if apiKey != "" && subtle.ConstantTimeCompare([]byte(apiKey), []byte(token)) == 1 { // Need a bare-bones session object for later checks session := &model.Session{ Token: token,