bitwarden/server
1
0
Fork 0
mirror of https://github.com/bitwarden/server synced 2025-12-06 00:03:34 +00:00
Code Issues Releases Wiki Activity

fix(vuln): Change OTP and Email providers to use time-constant equality operators

Browse Source 
Co-authored-by: Todd Martin <106564991+trmartin4@users.noreply.github.com>
This commit is contained in:
Kyle Spearrin
2025-10-28 09:51:24 -04:00
committed by GitHub
parent 76d7534d85
commit 02be34159d
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Core/Auth/Identity/TokenProviders/EmailTokenProvider.cs
View File

@@ -65,7 +65,7 @@ public class EmailTokenProvider : IUserTwoFactorTokenProvider<User>
} }
var code = Encoding.UTF8.GetString(cachedValue); var code = Encoding.UTF8.GetString(cachedValue);
var valid = string.Equals(token, code); var valid = CoreHelpers.FixedTimeEquals(token, code);
if (valid) if (valid)
{ {
await _distributedCache.RemoveAsync(cacheKey); await _distributedCache.RemoveAsync(cacheKey);

2
src/Core/Auth/Identity/TokenProviders/OtpTokenProvider/OtpTokenProvider.cs
View File

@@ -64,7 +64,7 @@ public class OtpTokenProvider<TOptions>(
} }
var code = Encoding.UTF8.GetString(cachedValue); var code = Encoding.UTF8.GetString(cachedValue);
var valid = string.Equals(token, code); var valid = CoreHelpers.FixedTimeEquals(token, code);
if (valid) if (valid)
{ {
await _distributedCache.RemoveAsync(cacheKey); await _distributedCache.RemoveAsync(cacheKey);