molecule-ai/molecule-core
35
0
Fork 2
Code Issues 16 Pull Requests 2 Actions 49 Packages Projects Releases Wiki Activity

Merge pull request #343 from Molecule-AI/fix/issue-337-webhook-secret-constant-time

Browse Source 
fix(security): constant-time webhook_secret comparison (#337)
This commit is contained in:
Hongming Wang 2026-04-15 21:31:02 -07:00 committed by GitHub
commit c5d40b861b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
platform/internal/handlers/channels.go
View File

@ -2,6 +2,7 @@ package handlers
import (
"context"
"crypto/subtle"
"database/sql"
"encoding/json"
"log"
@ -435,10 +436,17 @@ func (h *ChannelHandler) Webhook(c *gin.Context) {
continue
}
// Verify webhook secret_token if the channel has one configured
// Verify webhook secret_token if the channel has one configured.
// #337: use constant-time comparison. Go's `!=` short-circuits on
// the first mismatched byte and leaks timing information; an
// attacker on the Docker network could enumerate the secret
// byte-by-byte. subtle.ConstantTimeCompare runs in time
// proportional to the length of the shorter input and returns
// 1 on match / 0 otherwise (never -1). Same posture as the
// cdp-proxy token compare in host-bridge.
if expectedSecret, _ := row.Config["webhook_secret"].(string); expectedSecret != "" {
receivedSecret := c.GetHeader("X-Telegram-Bot-Api-Secret-Token")
if receivedSecret != expectedSecret {
if subtle.ConstantTimeCompare([]byte(receivedSecret), []byte(expectedSecret)) != 1 {
continue // Wrong secret — try other channels (could be different bot)
}
}