[pulsar] branch branch-2.11 updated: [fix][broker] Use MessageDigest.isEqual when comparing digests (#21061)

[mm...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

mmarshall pushed a commit to branch branch-2.11
in repository https://gitbox.apache.org/repos/asf/pulsar.git


The following commit(s) were added to refs/heads/branch-2.11 by this push:
     new 6274fa01a75 [fix][broker] Use MessageDigest.isEqual when comparing digests (#21061)
6274fa01a75 is described below

commit 6274fa01a75d74d559bb7e514c970f1fc07d15bc
Author: Yiheng Cao <65...@users.noreply.github.com>
AuthorDate: Fri Aug 25 00:41:32 2023 +0800

    [fix][broker] Use MessageDigest.isEqual when comparing digests (#21061)
    
    (cherry picked from commit c05954e66ff33098aeb848f4bde51613ace7e47e)
---
 .../org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java b/pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java
index 6ded38132e1..9d90cc26ec0 100644
--- a/pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java
+++ b/pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java
@@ -76,7 +76,7 @@ public class SaslRoleTokenSigner {
         String originalSignature = signedStr.substring(index + SIGNATURE.length());
         String rawValue = signedStr.substring(0, index);
         String currentSignature = computeSignature(rawValue);
-        if (!originalSignature.equals(currentSignature)) {
+        if (!MessageDigest.isEqual(originalSignature.getBytes(), currentSignature.getBytes())){
             throw new AuthenticationException("Invalid signature");
         }
         return rawValue;