arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-04-19 23:22:16 +03:00
Code

Fix long password validation in WebServer (#7676)

Browse Source 
Use a base64 encode that doesn't add CRs to the output when comparing
username:password values for authentication.

Fixes #7664
This commit is contained in:
Earle F. Philhower, III 2020-10-25 04:03:02 -07:00 committed by GitHub
parent 8d2f53d9a2
commit c65626622a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libraries/ESP8266WebServer/src/ESP8266WebServer-impl.h
View File

@ -26,6 +26,7 @@
#include "WiFiClient.h"
#include "ESP8266WebServer.h"
#include "FS.h"
#include "base64.h"
#include "detail/RequestHandlersImpl.h"
static const char AUTHORIZATION_HEADER[] PROGMEM = "Authorization";
@ -98,21 +99,19 @@ bool ESP8266WebServerTemplate<ServerType>::authenticate(const char * username, c
authReq = "";
return false;
}
char *encoded = new (std::nothrow) char[base64_encode_expected_len(toencodeLen)+1];
if(encoded == NULL){
sprintf(toencode, "%s:%s", username, password);
String encoded = base64::encode((uint8_t *)toencode, toencodeLen, false);
if(!encoded){
authReq = "";
delete[] toencode;
return false;
}
sprintf(toencode, "%s:%s", username, password);
if(base64_encode_chars(toencode, toencodeLen, encoded) > 0 && authReq.equalsConstantTime(encoded)) {
if(authReq.equalsConstantTime(encoded)) {
authReq = "";
delete[] toencode;
delete[] encoded;
return true;
}
delete[] toencode;
delete[] encoded;
} else if(authReq.startsWith(F("Digest"))) {
String _realm = _extractParam(authReq, F("realm=\""));
String _H1 = credentialHash((String)username,_realm,(String)password);