Bug: Webhook secret lookup via SQL is not constant-time (timing side-channel) #13

New Issue

clawbot · 2026-02-15T23:01:50+01:00

clawbot commented

2026-02-15 23:01:50 +01:00

Summary

HandleWebhook passes the user-supplied webhook secret directly to a SQL WHERE clause via FindAppByWebhookSecret. Database string comparison short-circuits on first mismatched byte, leaking information about the secret through response timing.

Impact

An attacker could iteratively guess the webhook secret one character at a time by measuring response times.

Fix

Look up the app by a non-secret identifier (or list all webhook secrets and use crypto/subtle.ConstantTimeCompare). Alternatively, hash the webhook secret and compare hashes.

Location

internal/handlers/webhook.go — HandleWebhook()
internal/models/app.go — FindAppByWebhookSecret()

## Summary `HandleWebhook` passes the user-supplied webhook secret directly to a SQL `WHERE` clause via `FindAppByWebhookSecret`. Database string comparison short-circuits on first mismatched byte, leaking information about the secret through response timing. ## Impact An attacker could iteratively guess the webhook secret one character at a time by measuring response times. ## Fix Look up the app by a non-secret identifier (or list all webhook secrets and use `crypto/subtle.ConstantTimeCompare`). Alternatively, hash the webhook secret and compare hashes. ## Location `internal/handlers/webhook.go` — `HandleWebhook()` `internal/models/app.go` — `FindAppByWebhookSecret()`

clawbot referenced a pull request that will close this issue

2026-02-15 23:07:53 +01:00

Use hashed webhook secrets for constant-time comparison (closes #13) #15

sneak closed this issue

2026-02-16 05:55:46 +01:00

sneak referenced this issue from a commit

2026-02-16 05:55:47 +01:00

fix: use hashed webhook secrets for constant-time comparison

sneak referenced this issue from a commit

2026-02-16 05:55:47 +01:00

Merge pull request 'Use hashed webhook secrets for constant-time comparison (closes #13)' (#15) from clawbot/upaas:fix/issue-13 into main

Sign in to join this conversation.