Deuxfleurs/garage
48
56
Fork 73
Code Issues 100 Pull requests 13 Releases 30 Wiki Activity

Security: backport #737 to the v0.8.x branch #740

Merged
lx merged 2 commits from backport-737-0.8.x into main-0.8.x 2024-03-01 11:16:41 +00:00
Conversation 0 Commits 2 Files changed 5 +3 -3
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 70899b0e37 - Show all commits

6
src/api/signature/payload.rs
View file

@ -350,9 +350,9 @@ pub async fn verify_v4(
)
.ok_or_internal_error("Unable to build signing HMAC")?;
hmac.update(payload);
let our_signature = hex::encode(hmac.finalize().into_bytes());
if signature != our_signature {
return Err(Error::forbidden("Invalid signature".to_string()));
let signature = hex::decode(&signature).map_err(|_| Error::forbidden("Invalid signature"))?;
if hmac.verify_slice(&signature).is_err() {
return Err(Error::forbidden("Invalid signature"));
}
Ok(key)