[SECURITY-241] Use US-ASCII to prevent charset issues

core/src/main/java/jenkins/security/ApiTokenProperty.java

@@ -41,6 +41,7 @@ import org.kohsuke.stapler.StaplerRequest;
 import org.kohsuke.stapler.StaplerResponse;
 
 import java.io.IOException;
+import java.nio.charset.Charset;
 import java.security.MessageDigest;
 import java.security.SecureRandom;
 import javax.annotation.Nonnull;
@@ -111,7 +112,8 @@ public class ApiTokenProperty extends UserProperty {
 
     public boolean matchesPassword(String password) {
         String token = getApiTokenInsecure();
-        return MessageDigest.isEqual(password.getBytes(), token.getBytes());
+        return MessageDigest.isEqual(password.getBytes(Charset.forName("US-ASCII")),
+                token.getBytes(Charset.forName("US-ASCII")));
     }
     
     private boolean hasPermissionToSeeToken() {