Use timingSafeEqual

ChiChou · Oct 21, 2024 · 7a8d63e · 7a8d63e
1 parent ece84f8
commit 7a8d63e
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/server/lib/channels.ts b/server/lib/channels.ts
@@ -1,6 +1,7 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
 import * as frida from 'frida'
 import http from 'http'
+import { timingSafeEqual } from 'crypto'
 
 import { Server, Namespace, Socket } from 'socket.io'
 import REPL from './repl'
@@ -43,8 +44,8 @@ export default class Channels {
     this.changedSignal = this.onchange.bind(this)
     mgr.changed.connect(this.changedSignal)
 
-    const validate = (socket: Socket) =>{
-      if (socket.handshake.auth.token !== this.token) {
+    const validate = (socket: Socket) => {
+      if (!timingSafeEqual(socket.handshake.auth.token, this.token)) {
         socket.disconnect()
       }
     }