From f4361496a99566ab76b7e6ff9a37fa4060a84ae3 Mon Sep 17 00:00:00 2001 From: =?utf8?q?J=C3=A9r=C3=B4me=20Benoit?= Date: Wed, 11 Feb 2026 16:42:24 +0100 Subject: [PATCH] fix(ui-server): use timing-safe credential comparison Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode) Co-authored-by: Sisyphus --- src/charging-station/ui-server/AbstractUIServer.ts | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/charging-station/ui-server/AbstractUIServer.ts b/src/charging-station/ui-server/AbstractUIServer.ts index 312a97c4..f9d2aa0d 100644 --- a/src/charging-station/ui-server/AbstractUIServer.ts +++ b/src/charging-station/ui-server/AbstractUIServer.ts @@ -23,6 +23,7 @@ import { import { isEmpty, logger } from '../../utils/index.js' import { UIServiceFactory } from './ui-services/UIServiceFactory.js' import { getUsernameAndPasswordFromAuthorizationToken } from './UIServerUtils.js' +import { isValidCredential } from './UIServerSecurity.js' const moduleName = 'AbstractUIServer' @@ -226,8 +227,8 @@ export abstract class AbstractUIServer { private isValidUsernameAndPassword (username: string, password: string): boolean { return ( - this.uiServerConfiguration.authentication?.username === username && - this.uiServerConfiguration.authentication.password === password + isValidCredential(username, this.uiServerConfiguration.authentication?.username ?? '') && + isValidCredential(password, this.uiServerConfiguration.authentication?.password ?? '') ) } -- 2.53.0