Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: use time-constant comparison for security tokens #9896

Merged
merged 1 commit into from Jan 28, 2021
Merged

fix: use time-constant comparison for security tokens #9896

merged 1 commit into from Jan 28, 2021

Conversation

Legioth
Copy link
Member

@Legioth Legioth commented Jan 27, 2021

This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

@Legioth
use time-constant comparison for security tokens
7c66608 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.
@vaadin-bot
Copy link
Collaborator

SonarQube analysis reported 1 issue

Note: The following issues were found on lines that were not modified in the pull request. Because these issues can't be reported as line comments, they are summarized here:

  1. INFO VaadinSession.java#L77: Do not forget to remove this deprecated code someday. rule

@pleku pleku changed the title use time-constant comparison for security tokens fix: use time-constant comparison for security tokens Jan 28, 2021
@pleku pleku merged commit 088293f into master Jan 28, 2021
@pleku pleku deleted the constantTimeTokenComparison branch January 28, 2021 07:38
This was referenced Jan 28, 2021
Closed
Closed
taefi pushed a commit that referenced this pull request Jan 28, 2021
@Legioth @taefi
fix: use time-constant comparison for security tokens (#9896)
e9a7f5b 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

(cherry picked from commit 088293f)
taefi pushed a commit that referenced this pull request Jan 28, 2021
@Legioth @taefi
fix: use time-constant comparison for security tokens (#9896)
93b80d2 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

(cherry picked from commit 088293f)
pleku pushed a commit that referenced this pull request Jan 28, 2021
@Legioth @pleku
fix: use time-constant comparison for security tokens (#9896)
9c8583e 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

(cherry picked from commit 088293f)
pleku pushed a commit that referenced this pull request Jan 28, 2021
@Legioth @pleku
fix: use time-constant comparison for security tokens (#9896)
00fe432 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

(cherry picked from commit 088293f)
taefi pushed a commit that referenced this pull request Jan 28, 2021
@Legioth @taefi
fix: use time-constant comparison for security tokens (#9896)
d9cbe85 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

(cherry picked from commit 088293f)
vaadin-bot pushed a commit that referenced this pull request Jan 28, 2021
@Legioth @vaadin-bot
fix: use time-constant comparison for security tokens (#9896)
93cde47 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.
taefi pushed a commit that referenced this pull request Jan 28, 2021
@Legioth @taefi
fix: use time-constant comparison for security tokens (#9896)
9f9b7fb 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

(cherry picked from commit 088293f)
pleku pushed a commit that referenced this pull request Jan 29, 2021
@Legioth @pleku
fix: use time-constant comparison for security tokens (#9896)
9c683ad 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

(cherry picked from commit 088293f)
Ansku pushed a commit to vaadin/framework that referenced this pull request Jan 29, 2021
@TatuLund
fix: use time-constant comparison for security tokens (#12189)
885c229 
This is the same as #12188,
but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

Cherry-picked from: vaadin/flow#9896
tanbt pushed a commit that referenced this pull request Feb 3, 2021
@Legioth @tanbt
fix: use time-constant comparison for security tokens (#9896)
acc7ea4 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.
caalador pushed a commit that referenced this pull request Feb 3, 2021
@Legioth @caalador
fix: use time-constant comparison for security tokens (#9896)
69aa659 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.
Ansku pushed a commit to vaadin/framework that referenced this pull request Feb 3, 2021
@TatuLund @Ansku
fix: use time-constant comparison for security tokens (#12189)
cce86cc 
This is the same as #12188,
but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

Cherry-picked from: vaadin/flow#9896
@Ansku Ansku mentioned this pull request Feb 3, 2021
Merged
Ansku added a commit to vaadin/framework that referenced this pull request Feb 3, 2021
@Ansku
fix: use time-constant comparison for security tokens (#12189) (#12195)
560cccc 
This is the same as #12188,
but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

Cherry-picked from: vaadin/flow#9896

Authored-by: Tatu Lund <tatu@vaadin.com>
tanbt pushed a commit that referenced this pull request Feb 4, 2021
@vaadin-bot @Legioth
fix: use time-constant comparison for security tokens (#9896) (#9910)
ad15179 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

Co-authored-by: Leif Åstrand <leif@vaadin.com>
tanbt pushed a commit that referenced this pull request Feb 5, 2021
@vaadin-bot @Legioth @tanbt
fix: use time-constant comparison for security tokens (#9896) (#9910)
8c114e5 
This is the same as #9875, but also applied for the upload security key
and the push id since both of those are also used to protect against
cross-site attacks. In addition, documentation for the push id is
clarified to point out its role.

Co-authored-by: Leif Åstrand <leif@vaadin.com>
@tanbt tanbt added this to the 1.0.14 milestone Feb 8, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@pleku pleku pleku approved these changes

Assignees
No one assigned
Labels
need to pick manually 2.4 need to pick manually 2.5 prerelease version for platform 19.0.0 Released with Platform 14.4.7 Released with Platform 19.0.0.alpha5 to be cherry picked +0.0.1
Projects
None yet
Milestone
1.0.14
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@Legioth @vaadin-bot @pleku @tanbt @ZheSun88