You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by "Chenjp (via GitHub)" <gi...@apache.org> on 2026/06/29 05:47:06 UTC
[PR] Const time equal params order [tomcat]
Chenjp opened a new pull request, #1028:
URL: https://github.com/apache/tomcat/pull/1028
Ensure the first one is from server-side, and the 2nd is came from user input.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Const time equal params order [tomcat]
Posted by "markt-asf (via GitHub)" <gi...@apache.org>.
markt-asf closed pull request #1028: Const time equal params order
URL: https://github.com/apache/tomcat/pull/1028
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Const time equal params order [tomcat]
Posted by "ChristopherSchultz (via GitHub)" <gi...@apache.org>.
ChristopherSchultz commented on PR #1028:
URL: https://github.com/apache/tomcat/pull/1028#issuecomment-4982514405
I actually had this backward in my mind, thinking that user-input-first was better because it would mean that runtime is based upon the user's input, which they already know and wouldn't learn anything about the secret. But I think that constant-time across calls is actually better, where regardless of the user-input, the comparison always takes the same amount of time.
It also means that the attacker can't send unreasonably-large values and cause `equals()` to run longer than necessary.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Const time equal params order [tomcat]
Posted by "ChristopherSchultz (via GitHub)" <gi...@apache.org>.
ChristopherSchultz commented on PR #1028:
URL: https://github.com/apache/tomcat/pull/1028#issuecomment-4982450711
-1
Using the user-provided string first means the runtime of the function is determined by the user's provided value which is the intended behavior. Swapping these arguments means that the server-trusted argument is used to determine the runtime of the comparison instead of the user-provided String, which could potentially leak timing information about the stored (presumably secret) credential.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Const time equal params order [tomcat]
Posted by "markt-asf (via GitHub)" <gi...@apache.org>.
markt-asf commented on PR #1028:
URL: https://github.com/apache/tomcat/pull/1028#issuecomment-4830237656
Please provide a justification for this change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Const time equal params order [tomcat]
Posted by "markt-asf (via GitHub)" <gi...@apache.org>.
markt-asf commented on PR #1028:
URL: https://github.com/apache/tomcat/pull/1028#issuecomment-4982919255
You could argue it either way. I think, on balance, time based on user input is marginally lower risk (assuming sensible per request limits).
I'm not seeing a strong argument in favour of either approach which for me suggests retaining the status quo.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: [PR] Const time equal params order [tomcat]
Posted by "markt-asf (via GitHub)" <gi...@apache.org>.
markt-asf commented on PR #1028:
URL: https://github.com/apache/tomcat/pull/1028#issuecomment-5115223817
Closing as no basis provided for change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org