nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-04-05 13:08:17 -05:00
Code

use fixed-time comparison of secrets (#1698)

Browse Source
This commit is contained in:
Kyle Spearrin 2021-11-08 15:55:42 -05:00 committed by GitHub
parent c07794e907
commit 7cc7b84eaf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
8 changed files with 18 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/Api/Utilities/ApiHelpers.cs
View File

@ -1,4 +1,5 @@
using Microsoft.AspNetCore.Http; using Bit.Core.Utilities;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.EventGrid; using Microsoft.Azure.EventGrid;
using Microsoft.Azure.EventGrid.Models; using Microsoft.Azure.EventGrid.Models;
@ -48,7 +49,7 @@ namespace Bit.Api.Utilities
{ {
var queryKey = request.Query["key"]; var queryKey = request.Query["key"];
if (queryKey != EventGridKey) if (!CoreHelpers.FixedTimeEquals(queryKey, EventGridKey))
{ {
return new UnauthorizedObjectResult("Authentication failed. Please use a valid key."); return new UnauthorizedObjectResult("Authentication failed. Please use a valid key.");
} }

3
src/Billing/Controllers/AppleController.cs
View File

@ -1,4 +1,5 @@
using Bit.Core; using Bit.Core;
using Bit.Core.Utilities;
using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging; using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options; using Microsoft.Extensions.Options;
@ -34,7 +35,7 @@ namespace Bit.Billing.Controllers
var key = HttpContext.Request.Query.ContainsKey("key") ? var key = HttpContext.Request.Query.ContainsKey("key") ?
HttpContext.Request.Query["key"].ToString() : null; HttpContext.Request.Query["key"].ToString() : null;
if (key != _billingSettings.AppleWebhookKey) if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.AppleWebhookKey))
{ {
return new BadRequestResult(); return new BadRequestResult();
} }

2
src/Billing/Controllers/BitPayController.cs
View File

@ -49,7 +49,7 @@ namespace Bit.Billing.Controllers
[HttpPost("ipn")] [HttpPost("ipn")]
public async Task<IActionResult> PostIpn([FromBody] BitPayEventModel model, [FromQuery] string key) public async Task<IActionResult> PostIpn([FromBody] BitPayEventModel model, [FromQuery] string key)
{ {
if (key != _billingSettings.BitPayWebhookKey) if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.BitPayWebhookKey))
{ {
return new BadRequestResult(); return new BadRequestResult();
} }

3
src/Billing/Controllers/FreshdeskController.cs
View File

@ -14,6 +14,7 @@ using System.Threading.Tasks;
using System.ComponentModel.DataAnnotations; using System.ComponentModel.DataAnnotations;
using Bit.Core.Settings; using Bit.Core.Settings;
using Bit.Core.Utilities;
namespace Bit.Billing.Controllers namespace Bit.Billing.Controllers
{ {
@ -57,7 +58,7 @@ namespace Bit.Billing.Controllers
var key = HttpContext.Request.Query.ContainsKey("key") ? var key = HttpContext.Request.Query.ContainsKey("key") ?
HttpContext.Request.Query["key"].ToString() : null; HttpContext.Request.Query["key"].ToString() : null;
if (key != _billingSettings.FreshdeskWebhookKey) if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.FreshdeskWebhookKey))
{ {
return new BadRequestResult(); return new BadRequestResult();
} }

3
src/Billing/Controllers/PayPalController.cs
View File

@ -3,6 +3,7 @@ using Bit.Core.Enums;
using Bit.Core.Models.Table; using Bit.Core.Models.Table;
using Bit.Core.Repositories; using Bit.Core.Repositories;
using Bit.Core.Services; using Bit.Core.Services;
using Bit.Core.Utilities;
using Microsoft.AspNetCore.Mvc; using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging; using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options; using Microsoft.Extensions.Options;
@ -56,7 +57,7 @@ namespace Bit.Billing.Controllers
var key = HttpContext.Request.Query.ContainsKey("key") ? var key = HttpContext.Request.Query.ContainsKey("key") ?
HttpContext.Request.Query["key"].ToString() : null; HttpContext.Request.Query["key"].ToString() : null;
if (key != _billingSettings.PayPal.WebhookKey) if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.PayPal.WebhookKey))
{ {
_logger.LogWarning("PayPal webhook key is incorrect or does not exist."); _logger.LogWarning("PayPal webhook key is incorrect or does not exist.");
return new BadRequestResult(); return new BadRequestResult();

2
src/Billing/Controllers/StripeController.cs
View File

@ -80,7 +80,7 @@ namespace Bit.Billing.Controllers
[HttpPost("webhook")] [HttpPost("webhook")]
public async Task<IActionResult> PostWebhook([FromQuery] string key) public async Task<IActionResult> PostWebhook([FromQuery] string key)
{ {
if (key != _billingSettings.StripeWebhookKey) if (!CoreHelpers.FixedTimeEquals(key, _billingSettings.StripeWebhookKey))
{ {
return new BadRequestResult(); return new BadRequestResult();
} }

2
src/Core/Services/Implementations/UserService.cs
View File

@ -893,7 +893,7 @@ namespace Bit.Core.Services
return false; return false;
} }
if (string.Compare(user.TwoFactorRecoveryCode, recoveryCode, true) != 0) if (!CoreHelpers.FixedTimeEquals(user.TwoFactorRecoveryCode, recoveryCode))
{ {
return false; return false;
} }

6
src/Core/Utilities/CoreHelpers.cs
View File

@ -921,5 +921,11 @@ namespace Bit.Core.Utilities
return text; return text;
} }
} }
public static bool FixedTimeEquals(string input1, string input2)
{
return CryptographicOperations.FixedTimeEquals(
Encoding.UTF8.GetBytes(input1), Encoding.UTF8.GetBytes(input2));
}
} }
} }