Zhengchao An 3c3113619e fix(protocols): use constant-time secret comparison in FTPS and WebDAV auth (#4403) ...

The FTPS and WebDAV authentication handlers compared the client-supplied secret
key against the stored secret with `String::eq`, which short-circuits on the
first differing byte. A network attacker who knows (or enumerates) a valid
access key can recover the secret key byte-by-byte via response-timing analysis;
neither path is rate limited.

Switch both to a constant-time comparison using `subtle::ConstantTimeEq`, the
same primitive the SFTP handler and `rustfs/src/auth.rs::constant_time_eq`
already use. `subtle` is added to the `ftps` and `webdav` feature dependency
sets (it was previously gated on `sftp` only).

Addresses GHSA-3p3x-734c-h5vx.

2026-07-08 09:31:51 +08:00

..

src

fix(protocols): use constant-time secret comparison in FTPS and WebDAV auth (#4403)

2026-07-08 09:31:51 +08:00

tests

chore(swift): remove placeholder SSE module (#4330)

2026-07-07 04:29:24 +08:00

Cargo.toml

fix(protocols): use constant-time secret comparison in FTPS and WebDAV auth (#4403)

2026-07-08 09:31:51 +08:00