Zhengchao An 3c3113619e fix(protocols): use constant-time secret comparison in FTPS and WebDAV auth (#4403) ...

The FTPS and WebDAV authentication handlers compared the client-supplied secret
key against the stored secret with `String::eq`, which short-circuits on the
first differing byte. A network attacker who knows (or enumerates) a valid
access key can recover the secret key byte-by-byte via response-timing analysis;
neither path is rate limited.

Switch both to a constant-time comparison using `subtle::ConstantTimeEq`, the
same primitive the SFTP handler and `rustfs/src/auth.rs::constant_time_eq`
already use. `subtle` is added to the `ftps` and `webdav` feature dependency
sets (it was previously gated on `sftp` only).

Addresses GHSA-3p3x-734c-h5vx.

2026-07-08 09:31:51 +08:00

..

common

refactor: route notify dispatch through app context (#3789)

2026-06-23 20:05:28 +08:00

ftps

fix(protocols): use constant-time secret comparison in FTPS and WebDAV auth (#4403)

2026-07-08 09:31:51 +08:00

sftp

feat(storage): harden internode data-path controls (#4224)

2026-07-03 17:08:15 +08:00

swift

fix(protocols): allow clippy::type_complexity in expiration worker tests (#4395)

2026-07-08 08:01:13 +08:00

webdav

fix(protocols): use constant-time secret comparison in FTPS and WebDAV auth (#4403)

2026-07-08 09:31:51 +08:00

constants.rs

feat(sftp): add SFTPv3 protocol support (#2875)

2026-05-10 03:48:42 +00:00

lib.rs

refactor(tls): centralize runtime foundation (#3065)

2026-05-24 06:41:15 +00:00