fix(protocols): constant-time FormPost signature check and guard DLO/SLO range underflow (#4519)

crates/protocols/src/swift/formpost.rs

@@ -209,7 +209,19 @@ pub fn validate_formpost(path: &str, request: &FormPostRequest, key: &str) -> Sw
         key,
     )?;
 
-    if request.signature != expected_sig {
+    // Compare signatures in constant time to avoid a timing side-channel, matching
+    // the sibling TempURL/SFTP checks. Decode the hex first so the comparison runs
+    // over the raw HMAC bytes and does not leak via string length; a non-hex
+    // provided signature can never match and is rejected the same way.
+    let expected_bytes =
+        hex::decode(&expected_sig).map_err(|e| SwiftError::InternalServerError(format!("Signature encoding error: {}", e)))?;
+
+    let signatures_match = match hex::decode(request.signature.trim()) {
+        Ok(provided_bytes) => super::tempurl::constant_time_compare(&provided_bytes, &expected_bytes),
+        Err(_) => false,
+    };
+
+    if !signatures_match {
         debug!(
             event = EVENT_SWIFT_FORMPOST_STATE,
             component = LOG_COMPONENT_PROTOCOLS,
@@ -687,6 +699,30 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_validate_formpost_wrong_hex_signature() {
+        // A well-formed hex signature that does not match the expected one must still
+        // be rejected. This exercises the constant-time comparison path (the decoded
+        // bytes differ) rather than the hex-decode failure path.
+        let key = "mykey";
+        let path = "/v1/AUTH_test/container";
+        let expires = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs() + 3600;
+
+        let request = FormPostRequest {
+            redirect: "https://example.com/success".to_string(),
+            redirect_error: None,
+            max_file_size: 10485760,
+            max_file_count: 5,
+            expires,
+            // Valid 40-char hex, but not the correct signature for these params.
+            signature: "da39a3ee5e6b4b0d3255bfef95601890afd80709".to_string(),
+        };
+
+        let result = validate_formpost(path, &request, key);
+        assert!(result.is_err());
+        assert!(matches!(result.unwrap_err(), SwiftError::Unauthorized(_)));
+    }
+
     #[test]
     fn test_build_redirect_url() {
         let url = build_redirect_url("https://example.com/success", 201, "Created");