fix(webdav): constant-time compare on lock-token equality checks

Replace plain `==` on lock tokens with `subtle::ConstantTimeEq` at
every token-comparison site on the WebDAV surface. Closes a
reported timing side-channel (2026-09-05) in `evaluate_if_header`
where an authenticated attacker could theoretically recover another
user's active lock token via response-latency measurements on the
`If:` header state-token comparison.

Practical exploitability is marginal — the signal is tens-of-ns
buried under ms-scale network jitter, ~5×10⁸ samples needed per
token to average through the noise vs a default lock lifetime of
60 s to 1 h — but the fix is a five-line change with zero
measurable perf cost (`subtle` is already transitive via
sqlx-postgres → digest, so no new binary weight), and adopting
constant-time compare on any token that gates access matches the
hygiene rule the rest of the codebase already follows on password
and session paths.

Sites fixed:
* `evaluate_if_header` — first-pass state-token scan and
  second-pass condition eval in `webdav_handler.rs`.
* `WebdavLockService::refresh` — `!= token` mismatch check.
* `WebdavLockService::release` — `== token` guard on the
  by_path invalidation branch.

The two `WebdavLockService` sites are already gated by
`self.by_token.get(token)?` — the attacker cannot reach the
comparison without already presenting a valid token, so their
timing surface is nil in practice. Kept constant-time anyway for
callsite consistency.

Sweep confirmed no other secret-adjacent `==` in production code:
password verification goes through Argon2's `verify_password`,
session/CSRF/DPoP jti tokens are hashmap-gated, and blob-hash
equality compares two server-side values with no attacker-
controlled operand.

Reported-by: Abdurazzoqov Javohir <abdurazzoqovjavohir700-dev@users.noreply.github.com>
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

This commit is contained in:

Edouard Vanbelle

2026-09-05 23:13:49 +02:00

parent 3dd4167578

commit f598404d4a

4 changed files with 66 additions and 4 deletions

									
										Cargo.toml
									
		+7
		
												View File
												
				@@ -125,6 +125,13 @@ mp3-duration = "0.1"

				kamadak-exif = "0.6.1"

				md-5 = "0.11.0"

				sha2 = "0.11.0"

				# Constant-time equality primitives for security-sensitive comparisons.

				# Direct dep is free: `subtle` is already pulled in transitively via

				# sqlx-postgres → sha2 → digest, so this doesn't add a compile unit or

				# bytes — just makes the import explicit for our own callsites (WebDAV

				# lock-token comparison in `evaluate_if_header`, and any future

				# token/secret comparisons).

				subtle = "2.6"

				unicode-normalization = "0.1.25"

				blake3 = { version = "1.8.5", features = ["rayon", "mmap"] }

				hex = "0.4.3"