commit ecae8657d6dc43032154789f68e2f2e8697543f2
author Patrick Hiesel <hiesel@google.com> Mon Jun 24 10:54:28 2024 +0200
committer Patrick Hiesel <hiesel@google.com> Mon Jun 24 10:13:21 2024 +0000
tree 40babf4ab5486725f9be747837b04964bc0331aa
parent 546878b1bf075cad804d15bfe1cf217a0a28d524

Use constant time comparison

Release-Notes: Use constant-time comparison for hashed password validation, for increased security
Bug: b/348963674
Change-Id: Idc9f5580999acdc015bdf233ed50bffbadd991cf

java/com/google/gerrit/server/account/HashedPassword.java

diff --git a/java/com/google/gerrit/server/account/HashedPassword.java b/java/com/google/gerrit/server/account/HashedPassword.java
index 09115503..7a7c35b 100644
--- a/java/com/google/gerrit/server/account/HashedPassword.java
+++ b/java/com/google/gerrit/server/account/HashedPassword.java
@@ -136,6 +136,6 @@
 
   public boolean checkPassword(String password) {
     // Constant-time comparison, because we're paranoid.
-    return Arrays.areEqual(hashPassword(password, salt, cost, nullTerminate), hashed);
+    return Arrays.constantTimeAreEqual(hashPassword(password, salt, cost, nullTerminate), hashed);
   }
 }