fix(ui-server): use timing-safe credential comparison

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

diff --git a/src/charging-station/ui-server/AbstractUIServer.ts b/src/charging-station/ui-server/AbstractUIServer.ts
index 312a97c4aab93dc8146a9f8e55528a0c5673fe5a..f9d2aa0dff0378864d1eadf0c0001134f17d1e83 100644 (file)
--- a/src/charging-station/ui-server/AbstractUIServer.ts
+++ b/src/charging-station/ui-server/AbstractUIServer.ts
@@ -23,6 +23,7 @@ import {
 import { isEmpty, logger } from '../../utils/index.js'
 import { UIServiceFactory } from './ui-services/UIServiceFactory.js'
 import { getUsernameAndPasswordFromAuthorizationToken } from './UIServerUtils.js'
+import { isValidCredential } from './UIServerSecurity.js'
 
 const moduleName = 'AbstractUIServer'
 
@@ -226,8 +227,8 @@ export abstract class AbstractUIServer {
 
   private isValidUsernameAndPassword (username: string, password: string): boolean {
     return (
-      this.uiServerConfiguration.authentication?.username === username &&
-      this.uiServerConfiguration.authentication.password === password
+      isValidCredential(username, this.uiServerConfiguration.authentication?.username ?? '') &&
+      isValidCredential(password, this.uiServerConfiguration.authentication?.password ?? '')
     )
   }