fix(auth): pad to fixed length in safeCompare instead of self-compare

dorlugasigal · Copilot · dorlugasigal · commit 98b011d293b0 · 2026-04-23T18:31:39.000+03:00
The previous safeCompare did a no-op timingSafeEqual(ab, ab) on length
mismatch which doesn't actually equalize cost (same memory, trivially
equal). Replace with the standard fixed-length padding pattern: copy
both inputs into 256-byte zero-padded buffers, timingSafeEqual on those,
and AND with a real length check. Inputs longer than 256 bytes are
rejected outright (well beyond any reasonable password).

Co-authored-by: Copilot &lt;223556219+Copilot@users.noreply.github.com&gt;
diff --git a/src/server/auth.js b/src/server/auth.js
@@ -293,18 +293,23 @@ const LOGIN_HTML = `<!DOCTYPE html>
 // Constant-time string compare using crypto.timingSafeEqual on raw bytes.
 // We intentionally do NOT hash the inputs: this is an equality check against
 // an in-memory secret (never stored), and hashing would trip CodeQL's
-// js/insufficient-password-hash rule which is aimed at password *storage*.
-// When lengths differ we still run timingSafeEqual on the longer buffer
-// against itself so the branch cost is roughly constant.
+// js/insufficient-password-hash rule which targets password *storage*.
+//
+// To avoid leaking length via early-return, both inputs are copied into
+// fixed-length zero-padded buffers before timingSafeEqual, and the final
+// result is AND-ed with a real length check.
+const SAFE_COMPARE_LEN = 256;
 function safeCompare(a, b) {
   if (typeof a !== 'string' || typeof b !== 'string') return false;
   const ab = Buffer.from(a, 'utf8');
   const bb = Buffer.from(b, 'utf8');
-  if (ab.length !== bb.length) {
-    crypto.timingSafeEqual(ab, ab);
-    return false;
-  }
-  return crypto.timingSafeEqual(ab, bb);
+  if (ab.length > SAFE_COMPARE_LEN || bb.length > SAFE_COMPARE_LEN) return false;
+  const ap = Buffer.alloc(SAFE_COMPARE_LEN);
+  const bp = Buffer.alloc(SAFE_COMPARE_LEN);
+  ab.copy(ap);
+  bb.copy(bp);
+  const bytesEqual = crypto.timingSafeEqual(ap, bp);
+  return bytesEqual && ab.length === bb.length;
 }
 
 function createAuth(password) {
