JMR-devandClaude Opus 4.8
15737ad639
All changes are localized to RemoteWebServer plus two small helpers; the Phase 0 characterization tests confirm routing, JSON/Prometheus shape, and credential pass/fail semantics are otherwise unchanged. - Password hashing: new PasswordHasher uses PBKDF2-HMAC-SHA256 with a per-credential random salt (self-describing pbkdf2$iters$salt$hash). Verify() still accepts the legacy unsalted SHA-256 hex hash and a successful legacy auth transparently upgrades the stored hash, persisted by the view model on save/shutdown. Property renamed PasswordSHA256 -> PasswordHash. - Constant-time comparison: CredentialComparer.FixedTimeEquals for the user name and password hash; both are evaluated fully (no && short-circuit). - No information disclosure: POST failures return a generic message instead of ex.ToString(); detail is logged server-side only. - Bind intent respected: ResolveListenerIp no longer mutates ListenerIp or silently falls back to all-interfaces for a specific configured address (auto/'?'/wildcards still bind all). A bad address now fails Start(). - CORS: removed the Access-Control-Allow-Origin '*' wildcard; common response headers centralized in WriteCommonHeaders. - Prometheus: label values are escaped (EscapePrometheusLabel). 185 tests pass (was 167). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
21 lines
873 B
C#
21 lines
873 B
C#
// This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
|
|
// If a copy of the MPL was not distributed with this file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
// Copyright (C) LibreHardwareMonitor and Contributors.
|
|
|
|
using System.Security.Cryptography;
|
|
using System.Text;
|
|
|
|
namespace LibreHardwareMonitor.Windows.WinUI.Services;
|
|
|
|
internal static class CredentialComparer
|
|
{
|
|
/// <summary>
|
|
/// Compares two strings for equality in time that does not depend on where they first differ, so an attacker cannot
|
|
/// learn a correct prefix from response timing. Used for the user name and password-hash comparisons.
|
|
/// </summary>
|
|
public static bool FixedTimeEquals(string left, string right)
|
|
{
|
|
return CryptographicOperations.FixedTimeEquals(Encoding.UTF8.GetBytes(left), Encoding.UTF8.GetBytes(right));
|
|
}
|
|
}
|