mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-25 12:43:23 +00:00
Use constant time compare for bootstrap tokens
Signed-off-by: Joe Beda <joe.github@bedafamily.com>
This commit is contained in:
parent
5e29e1ee05
commit
c46d6bb825
@ -20,6 +20,7 @@ Package bootstrap provides a token authenticator for TLS bootstrap secrets.
|
||||
package bootstrap
|
||||
|
||||
import (
|
||||
"crypto/subtle"
|
||||
"fmt"
|
||||
"regexp"
|
||||
"time"
|
||||
@ -95,7 +96,7 @@ func (t *TokenAuthenticator) AuthenticateToken(token string) (user.Info, bool, e
|
||||
}
|
||||
|
||||
ts := getSecretString(secret, bootstrapapi.BootstrapTokenSecretKey)
|
||||
if ts != tokenSecret {
|
||||
if subtle.ConstantTimeCompare([]byte(ts), []byte(tokenSecret)) != 1 {
|
||||
return nil, false, nil
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user