fix: use constant-time comparison for API key validation#33986
Open
xr843 wants to merge 4 commits intolanggenius:mainfrom
Open
fix: use constant-time comparison for API key validation#33986xr843 wants to merge 4 commits intolanggenius:mainfrom
xr843 wants to merge 4 commits intolanggenius:mainfrom
Conversation
xr843
requested review from
Nov1c444,
QuantumGhost and
laipz8200
as code owners
Contributor
|
Warning You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again! |
dosubot
bot
added
the
size:M
4 tasks
Contributor
Pyrefly Diffbase → PR--- /tmp/pyrefly_base.txt 2026-03-24 00:08:55.984484758 +0000
+++ /tmp/pyrefly_pr.txt 2026-03-24 00:08:47.136528613 +0000
@@ -21,9 +21,9 @@
ERROR Object of class `NoneType` has no attribute `id` [missing-attribute]
--> controllers/console/human_input_form.py:190:70
ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
- --> controllers/console/init_validate.py:31:2
+ --> controllers/console/init_validate.py:32:2
ERROR Object of class `MissingRouter` has no attribute `post` [missing-attribute]
- --> controllers/console/init_validate.py:44:2
+ --> controllers/console/init_validate.py:45:2
ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
--> controllers/console/ping.py:10:2
ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
|
Contributor
Pyrefly Diffbase → PR--- /tmp/pyrefly_base.txt 2026-03-24 00:11:06.123580148 +0000
+++ /tmp/pyrefly_pr.txt 2026-03-24 00:10:55.856481113 +0000
@@ -21,9 +21,9 @@
ERROR Object of class `NoneType` has no attribute `id` [missing-attribute]
--> controllers/console/human_input_form.py:190:70
ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
- --> controllers/console/init_validate.py:31:2
+ --> controllers/console/init_validate.py:32:2
ERROR Object of class `MissingRouter` has no attribute `post` [missing-attribute]
- --> controllers/console/init_validate.py:44:2
+ --> controllers/console/init_validate.py:45:2
ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
--> controllers/console/ping.py:10:2
ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
|
2 tasks
- data_source.py: scope patch() query by tenant_id to prevent cross-tenant data source binding access (IDOR vulnerability) - test_auth_wraps.py: update mock to match db.session.query() API instead of db.session.get() Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Contributor
Pyrefly Diffbase → PR--- /tmp/pyrefly_base.txt 2026-03-28 07:16:39.949555767 +0000
+++ /tmp/pyrefly_pr.txt 2026-03-28 07:16:29.880518904 +0000
@@ -11,9 +11,9 @@
ERROR Argument `str | None` is not assignable to parameter `language` with type `str` in function `services.account_service.AccountService.send_email_register_email` [bad-argument-type]
--> controllers/console/auth/email_register.py:78:108
ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
- --> controllers/console/init_validate.py:31:2
+ --> controllers/console/init_validate.py:32:2
ERROR Object of class `MissingRouter` has no attribute `post` [missing-attribute]
- --> controllers/console/init_validate.py:44:2
+ --> controllers/console/init_validate.py:45:2
ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
--> controllers/console/ping.py:10:2
ERROR Object of class `MissingRouter` has no attribute `get` [missing-attribute]
|
Contributor
Author
|
Hi team, gentle ping on this PR. It replaces direct string comparison of API keys with |
Contributor
|
fix conflict |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
==withhmac.compare_digest()for API key and secret comparisons to prevent timing attackstenant_idcheck inDataSourceOauthBindingqueries to prevent IDOR vulnerabilitiesRebased on latest main to resolve CI failures from #33858 (which were caused by upstream test issues, now fixed in #33896 and #33899).
Supersedes #33858.