nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-06-30 23:52:50 -05:00
Code Activity

use fixed-time comparison of secrets (#1698)

Browse Source
This commit is contained in:
Kyle Spearrin
2021-11-08 15:55:42 -05:00
committed by GitHub
parent c07794e907
commit 7cc7b84eaf
8 changed files with 18 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/Core/Services/Implementations/UserService.cs
View File

@ -893,7 +893,7 @@ namespace Bit.Core.Services
return false;
}
if (string.Compare(user.TwoFactorRecoveryCode, recoveryCode, true) != 0)
if (!CoreHelpers.FixedTimeEquals(user.TwoFactorRecoveryCode, recoveryCode))
{
return false;
}

6
src/Core/Utilities/CoreHelpers.cs
View File

@ -921,5 +921,11 @@ namespace Bit.Core.Utilities
return text;
}
}
public static bool FixedTimeEquals(string input1, string input2)
{
return CryptographicOperations.FixedTimeEquals(
Encoding.UTF8.GetBytes(input1), Encoding.UTF8.GetBytes(input2));
}
}
}