[SECURITY-241] Add explanation for chosen implementation

919001c8 · Daniel Beck · def5bdb1 · 919001c8
隐藏空白更改
内联并排

Showing with 1 addition and 0 deletion

core/src/main/java/jenkins/security/ApiTokenProperty.java core/src/main/java/jenkins/security/ApiTokenProperty.java +1 -0

未找到文件。
--- a/core/src/main/java/jenkins/security/ApiTokenProperty.java
+++ b/core/src/main/java/jenkins/security/ApiTokenProperty.java
@@ -112,6 +112,7 @@ public class ApiTokenProperty extends UserProperty {

    public boolean matchesPassword(String password) {
        String token = getApiTokenInsecure();
+        // String.equals isn't constant time, but this is
        return MessageDigest.isEqual(password.getBytes(Charset.forName("US-ASCII")),
                token.getBytes(Charset.forName("US-ASCII")));
    }