Akatsuki-Misaki/ArchiSteamFarm
1
0
Fork 0
mirror of https://github.com/JustArchiNET/ArchiSteamFarm.git synced 2026-01-01 14:10:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use FixedTimeEquals for IPC Password testing (#3142)

Browse Source
This commit is contained in:
LRFLEW
2024-02-10 10:42:45 -06:00
committed by GitHub
parent e47f286bda
commit 6ab9e2958d
2 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
ArchiSteamFarm/Helpers/ArchiCryptoHelper.cs
View File

@@ -110,6 +110,21 @@ public static class ArchiCryptoHelper {
return Convert.ToBase64String(hashBytes);
}
internal static bool VerifyHash(EHashingMethod hashingMethod, string inputString, string verifyHash) {
if (!Enum.IsDefined(hashingMethod)) {
throw new InvalidEnumArgumentException(nameof(hashingMethod), (int) hashingMethod, typeof(EHashingMethod));
}
ArgumentException.ThrowIfNullOrEmpty(inputString);
ArgumentException.ThrowIfNullOrEmpty(verifyHash);
byte[] verifyBytes = hashingMethod == EHashingMethod.PlainText ? Encoding.UTF8.GetBytes(inputString) : Convert.FromBase64String(verifyHash);
byte[] passwordBytes = Encoding.UTF8.GetBytes(inputString);
byte[] hashBytes = Hash(passwordBytes, EncryptionKey, DefaultHashLength, hashingMethod);
return CryptographicOperations.FixedTimeEquals(hashBytes, verifyBytes);
}
internal static byte[] Hash(byte[] password, byte[] salt, byte hashLength, EHashingMethod hashingMethod) {
if ((password == null) || (password.Length == 0)) {
throw new ArgumentNullException(nameof(password));

4
ArchiSteamFarm/IPC/Integration/ApiAuthenticationMiddleware.cs
View File

@@ -148,9 +148,7 @@ internal sealed class ApiAuthenticationMiddleware {
ArchiCryptoHelper.EHashingMethod ipcPasswordFormat = ASF.GlobalConfig != null ? ASF.GlobalConfig.IPCPasswordFormat : GlobalConfig.DefaultIPCPasswordFormat;
string inputHash = ArchiCryptoHelper.Hash(ipcPasswordFormat, inputPassword);
bool authorized = ipcPassword == inputHash;
bool authorized = ArchiCryptoHelper.VerifyHash(ipcPasswordFormat, inputPassword, ipcPassword);
while (true) {
if (AuthorizationTasks.TryGetValue(clientIP, out Task? task)) {