🛡️ Sentinel: [CRITICAL] Fix Timing Leak in Secret Comparison#57
🛡️ Sentinel: [CRITICAL] Fix Timing Leak in Secret Comparison#57aloewright wants to merge 1 commit into
Conversation
…nputs This commit updates `timingSafeEqual` call sites in `apps/quill/src/routes/admin.ts` and `apps/quill/src/lib/polar.ts` to convert string arguments into `Uint8Array`s using `new TextEncoder().encode()` before comparing them. This prevents JIT optimizations and JavaScript engine string storage mechanisms from introducing timing side-channel leaks. Co-authored-by: aloewright <3641844+aloewright@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Warning Review limit reached
More reviews will be available in 54 minutes and 59 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the webhook verification and admin key validation to encode string inputs into byte arrays using TextEncoder before passing them to timingSafeEqual. However, the review comments highlight that comparing secrets of different lengths still leaks length information because timingSafeEqual returns early if the byte lengths do not match. To eliminate this timing side-channel, it is recommended to hash both the expected and provided values using SHA-256 before performing the comparison.
| if ( | ||
| version === "v1" && | ||
| sig && | ||
| (await timingSafeEqual( | ||
| new TextEncoder().encode(sig), | ||
| new TextEncoder().encode(expected) | ||
| )) | ||
| ) { |
There was a problem hiding this comment.
While timingSafeEqual prevents timing attacks on the content of the secrets, comparing strings of different lengths directly still leaks the length of the secret because timingSafeEqual returns early when the byte lengths of the inputs do not match.
To completely eliminate length-based timing leaks, hash both values using SHA-256 before passing them to timingSafeEqual. This ensures both inputs always have a fixed length of 32 bytes.
| if ( | |
| version === "v1" && | |
| sig && | |
| (await timingSafeEqual( | |
| new TextEncoder().encode(sig), | |
| new TextEncoder().encode(expected) | |
| )) | |
| ) { | |
| if ( | |
| version === "v1" && | |
| sig && | |
| (await timingSafeEqual( | |
| await crypto.subtle.digest("SHA-256", new TextEncoder().encode(sig)), | |
| await crypto.subtle.digest("SHA-256", new TextEncoder().encode(expected)) | |
| )) | |
| ) { |
| if ( | ||
| !provided || | ||
| !(await timingSafeEqual( | ||
| new TextEncoder().encode(expected), | ||
| new TextEncoder().encode(provided) | ||
| )) | ||
| ) { |
There was a problem hiding this comment.
Directly comparing secrets of different lengths using timingSafeEqual leaks the length of the expected admin key because the comparison returns early if the byte lengths do not match.
To prevent this length-based timing side-channel, hash both the expected and provided keys with SHA-256 before comparing them. This guarantees that both inputs to timingSafeEqual are always exactly 32 bytes.
| if ( | |
| !provided || | |
| !(await timingSafeEqual( | |
| new TextEncoder().encode(expected), | |
| new TextEncoder().encode(provided) | |
| )) | |
| ) { | |
| if ( | |
| !provided || | |
| !(await timingSafeEqual( | |
| await crypto.subtle.digest("SHA-256", new TextEncoder().encode(expected)), | |
| await crypto.subtle.digest("SHA-256", new TextEncoder().encode(provided)) | |
| )) | |
| ) { |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
postpilot | 37698ef | May 31 2026, 05:22 AM |
🚨 Severity: CRITICAL
💡 Vulnerability: Timing side-channel leak in secret comparisons using
timingSafeEqualwith string arguments.🎯 Impact: Attackers could potentially exploit timing differences to guess valid webhook signatures or admin API keys.
🔧 Fix: Encoded string arguments to
Uint8Arrayusingnew TextEncoder().encode()before passing them totimingSafeEqual.✅ Verification: Ensure the codebase builds correctly (
pnpm build) andpnpm checkpasses. Tests have also been run locally.PR created automatically by Jules for task 9781505603365335451 started by @aloewright