diff options
| author | Alex <alex@adnab.me> | 2024-03-01 11:16:41 +0000 |
|---|---|---|
| committer | Alex <alex@adnab.me> | 2024-03-01 11:16:41 +0000 |
| commit | f01883794e475f5dae3d2d4f621b020e1134fa47 (patch) | |
| tree | 8695d17a0c81b5b9120ad7d6e19d4ec1908be724 /src/api/signature | |
| parent | 9b44639844fe60add66286a161f69f817a2714cb (diff) | |
| parent | 70899b0e378fe671af177d87311568cd88e0fda2 (diff) | |
| download | garage-f01883794e475f5dae3d2d4f621b020e1134fa47.tar.gz garage-f01883794e475f5dae3d2d4f621b020e1134fa47.zip | |
Merge pull request 'Security: backport #737 to the v0.8.x branch' (#740) from backport-737-0.8.x into main-0.8.x
Reviewed-on: https://git.deuxfleurs.fr/Deuxfleurs/garage/pulls/740
Diffstat (limited to 'src/api/signature')
| -rw-r--r-- | src/api/signature/payload.rs | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/src/api/signature/payload.rs b/src/api/signature/payload.rs index b50fb3bb..4a84610c 100644 --- a/src/api/signature/payload.rs +++ b/src/api/signature/payload.rs @@ -350,9 +350,9 @@ pub async fn verify_v4( ) .ok_or_internal_error("Unable to build signing HMAC")?; hmac.update(payload); - let our_signature = hex::encode(hmac.finalize().into_bytes()); - if signature != our_signature { - return Err(Error::forbidden("Invalid signature".to_string())); + let signature = hex::decode(&signature).map_err(|_| Error::forbidden("Invalid signature"))?; + if hmac.verify_slice(&signature).is_err() { + return Err(Error::forbidden("Invalid signature")); } Ok(key) |