🛡️ Sentinel: [CRITICAL/HIGH] Fix timing attack vulnerability in token comparison

.jules/sentinel.md

@@ -0,0 +1,4 @@
+## 2024-05-24 - Timing Attack Vulnerability in Token Comparison
+**Vulnerability:** Comparing sensitive tokens using `Buffer.length` check before `crypto.timingSafeEqual` or using regular `===`.
+**Learning:** `timingSafeEqual` prevents timing attacks, but wrapping it in an early-return check on string/buffer length re-introduces the vulnerability because the attacker can learn the exact length of the required secret by observing timing differences.
+**Prevention:** Instead of checking lengths, hash both user-provided input and the stored secret to a fixed length (e.g. using `crypto.createHash('sha256')`) and then securely compare the hashes.

src/cli/commands/serve.ts

@@ -346,13 +346,11 @@ export async function handleServeCommand(_options: unknown, command: Command) {
 
           let isAuthenticated = false;
           if (scheme?.toLowerCase() === 'bearer' && token) {
-            const tokenBuffer = Buffer.from(token);
+            // Hash both tokens to a fixed length to prevent leaking length via timing differences
+            const tokenHash = crypto.createHash('sha256').update(token).digest();
             for (const authToken of authTokens) {
-              const authTokenBuffer = Buffer.from(authToken);
-              if (
-                tokenBuffer.length === authTokenBuffer.length &&
-                crypto.timingSafeEqual(tokenBuffer, authTokenBuffer)
-              ) {
+              const authTokenHash = crypto.createHash('sha256').update(authToken).digest();
+              if (crypto.timingSafeEqual(tokenHash, authTokenHash)) {
                 isAuthenticated = true;
                 break;
               }

tests/integration/prompt_templates.test.ts

@@ -36,7 +36,9 @@ describe('Prompt templates', () => {
 
     expect(planSystem).toContain('You are SalmonLoop.');
     expect(patchSystem).toContain('You are PATCH, a phase-native diff compiler.');
-    expect(autopilotSystem).toContain('You are a senior software engineer running in "autopilot" mode.');
+    expect(autopilotSystem).toContain(
+      'You are a senior software engineer running in "autopilot" mode.',
+    );
     expect(answerSystem).toContain('You are a coding assistant in "answer" mode.');
     expect(researchSystem).toContain('You are a research assistant.');
   });