thePR0M3TH3AN/TORCH
1
0 Fork 0
mirror of https://github.com/PR0M3TH3AN/TORCH.git synced 2026-10-31 18:01:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(dashboard): return timingSafeEqual result instead of discarding it

Browse Source 
The unequal-length branch of timingSafeCompare called
crypto.timingSafeEqual(paddedA, paddedB) but did not capture the return
value, unconditionally returning false and leaving the timing-safe
comparison as dead code.

Adds a regression test covering shorter, longer, and exact-match
credential lengths to lock in the correct behaviour.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
This commit is contained in:
thePR0M3TH3ANandClaude Sonnet 4.6 committed 2026-02-20 11:53:05 -05:00
1 parent a5f08ff082
commit a8ee3d39ea
2 files changed
+43 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/dashboard.mjs
+1 -2
View File
@@ -26,8 +26,7 @@ function timingSafeCompare(a, b) {
const paddedB = Buffer.alloc(maxLen);
bufA.copy(paddedA);
bufB.copy(paddedB);
crypto.timingSafeEqual(paddedA, paddedB);
return false;
return crypto.timingSafeEqual(paddedA, paddedB);
}
return crypto.timingSafeEqual(bufA, bufB);
}