🛡️ Sentinel: [CRITICAL/HIGH] Fix timing attack vulnerability in auth token validation

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2025-02-23 - Timing attack vulnerability in Auth Token validation
+**Vulnerability:** The token length was compared before performing the comparison with `timingSafeEqual`, which leaks the secret token length via an early return timing difference.
+**Learning:** `timingSafeEqual` throws an error if buffer lengths are different, which leads to developers creating a short-circuit fast path that leaks the secret's length.
+**Prevention:** Instead of checking buffer lengths, always hash both the user input and the stored secret using SHA-256 (or another secure hash algorithm) before using `timingSafeEqual`. This ensures that both values are a fixed length, avoiding timing differences.

src/cli/commands/serve.ts

@@ -349,10 +349,9 @@ export async function handleServeCommand(_options: unknown, command: Command) {
             const tokenBuffer = Buffer.from(token);
             for (const authToken of authTokens) {
               const authTokenBuffer = Buffer.from(authToken);
-              if (
-                tokenBuffer.length === authTokenBuffer.length &&
-                crypto.timingSafeEqual(tokenBuffer, authTokenBuffer)
-              ) {
+              const hash1 = crypto.createHash('sha256').update(tokenBuffer).digest();
+              const hash2 = crypto.createHash('sha256').update(authTokenBuffer).digest();
+              if (crypto.timingSafeEqual(hash1, hash2)) {
                 isAuthenticated = true;
                 break;
               }

tests/integration/prompt_templates.test.ts

@@ -36,7 +36,9 @@ describe('Prompt templates', () => {
 
     expect(planSystem).toContain('You are SalmonLoop.');
     expect(patchSystem).toContain('You are PATCH, a phase-native diff compiler.');
-    expect(autopilotSystem).toContain('You are a senior software engineer running in "autopilot" mode.');
+    expect(autopilotSystem).toContain(
+      'You are a senior software engineer running in "autopilot" mode.',
+    );
     expect(answerSystem).toContain('You are a coding assistant in "answer" mode.');
     expect(researchSystem).toContain('You are a research assistant.');
   });