From 65325a767c6d5e6a24c097e897d5c83a4f1fb5f1 Mon Sep 17 00:00:00 2001 From: Doug Lauder Date: Thu, 16 May 2024 08:26:04 -0400 Subject: [PATCH] Use ConstantTimeCompare when comparing token. (#27007) --- server/channels/app/session.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/server/channels/app/session.go b/server/channels/app/session.go index 27068d3a7a..c3352e2c54 100644 --- a/server/channels/app/session.go +++ b/server/channels/app/session.go @@ -4,6 +4,7 @@ package app import ( + "crypto/subtle" "errors" "math" "net/http" @@ -57,7 +58,7 @@ func (a *App) GetCloudSession(token string) (*model.Session, *model.AppError) { func (a *App) GetRemoteClusterSession(token string, remoteId string) (*model.Session, *model.AppError) { rc, appErr := a.GetRemoteCluster(remoteId) - if appErr == nil && rc.Token == token { + if appErr == nil && subtle.ConstantTimeCompare([]byte(rc.Token), []byte(token)) == 1 { // Need a bare-bones session object for later checks session := &model.Session{ Token: token,