gitea_admin/pragent-demo
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat: note search and shareable links #1

Open
gitea_admin wants to merge 2 commits from feat/search-and-sharing into main
pull from: feat/search-and-sharing
merge into: gitea_admin:main
Conversation 2 Commits 2 Files Changed 4
+1 -1
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 4e1285dc96 - Show all commits
app/auth.py
+1 -1
View File
2
 @@ -35,4 +35,4 @@ def make_share_token(note_id: int) -> str:
def check_share_token(supplied: str, expected: str) -> bool:
"""Validate a share token supplied in a URL."""
return supplied == expected
return hmac.compare_digest(supplied, expected)
pragent-bot commented 2026-08-18 12:33:52 +00:00
Outdated
Review
Copy Link
Copy Source

[CRITICAL] check_share_token compares the supplied token with ==, leaking the expected value byte-by-byte via a timing side-channel on every request; the repo's own verify_token already uses hmac.compare_digest and house rules require it.

Fix: Use hmac.compare_digest (hmac is already imported at the top of this file).

def check_share_token(supplied: str, expected: str) -> bool:
    """Validate a share token supplied in a URL."""
    return hmac.compare_digest(supplied, expected)

📎 ref: https://cwe.mitre.org/data/definitions/208.html

🪙 ~346 tok (11% · attributed output)

**[CRITICAL]** check_share_token compares the supplied token with `==`, leaking the expected value byte-by-byte via a timing side-channel on every request; the repo's own verify_token already uses hmac.compare_digest and house rules require it. Fix: Use hmac.compare_digest (hmac is already imported at the top of this file). ```python def check_share_token(supplied: str, expected: str) -> bool: """Validate a share token supplied in a URL.""" return hmac.compare_digest(supplied, expected) ``` 📎 ref: https://cwe.mitre.org/data/definitions/208.html 🪙 ~346 tok (11% · attributed output)