Mxmilu666/frp
1
1
Fork 1
mirror of https://github.com/fatedier/frp.git synced 2026-03-21 17:29:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

use constant time comparison (#3452)

Browse Source
This commit is contained in:
fatedier
2023-05-29 00:27:27 +08:00
committed by GitHub
parent 756dd1ad5e
commit 4915852b9c
11 changed files with 45 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
pkg/plugin/client/http_proxy.go
View File

@@ -21,11 +21,13 @@ import (
"net"
"net/http"
"strings"
"time"
frpIo "github.com/fatedier/golib/io"
gnet "github.com/fatedier/golib/net"
frpNet "github.com/fatedier/frp/pkg/util/net"
"github.com/fatedier/frp/pkg/util/util"
)
const PluginHTTPProxy = "http_proxy"
@@ -179,7 +181,9 @@ func (hp *HTTPProxy) Auth(req *http.Request) bool {
return false
}
if pair[0] != hp.AuthUser || pair[1] != hp.AuthPasswd {
if !util.ConstantTimeEqString(pair[0], hp.AuthUser) ||
!util.ConstantTimeEqString(pair[1], hp.AuthPasswd) {
time.Sleep(200 * time.Millisecond)
return false
}
return true